Sicurezza-Informatica-Presentazione

¿Qué contiene este repositorio? Este repositorio contiene una breve investigación y una presentación de la vulnerabilidad de seguridad relacionada con XZ Utils para el curso de seguridad informática UNIPR. CVE-2024-3094 Descripción de la vulnerabilidad por parte de Ubuntu: Se descubrió código...

CVE-2024-8465-PoC

CVE-2024-8465 – Prueba de Concepto de Inyección SQL Información del Equipo Nombre del Equipo: The Misfits Miembros del Equipo: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Resumen Este repositorio contiene una aplicación web vulnerable creada como una Prueba de Concept...

CVE-2026-107104 Unsafe Deserialization Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successf...

CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider 5.4.6 - modOsTouchSliderHelper::getAjax, wired through Joomla’s core comajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser,...

CVE-2026-102781

The OrdaSoft Touch Slider Joomla extension versions prior to 5.4.6 is vulnerable to unauthenticated destructive CRUD operations. The root cause is a lack of access control, authentication checks (missing JFactory::getUser()), and CSRF token verification within the modOsTouchSliderHelper::getAjax(...

CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider 5.4.6 - modOsTouchSliderHelper::getAjax, wired through Joomla’s core comajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser,...

CVE-2026-98356

A flaw was found in the Linux kernel's Broadcom NetXtreme bnxtre driver. During device initialization, the driver fails to verify that memory allocation for the Data Center Bridging DCB workqueue succeeded. Under low-memory conditions where this setup fails, a subsequent asynchronous DCB...

EUVD-2026-94213

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

kernel: ipv6: fix use-after-free in ip6_finish_output2()

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

CVE-2026-97188

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-96530

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-86816

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-104667

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

LocalExifGeoMap

Local Exif Geo Map 📍 Una potente herramienta basada en navegador, centrada en la privacidad, para visualizar y analizar datos GPS de tus fotos. Simplemente arrastra y suelta imágenes para generar mapas interactivos, mapas de calor, perfiles de elevación y estadísticas de viaje. ¿Por qué? Siempre...

Juniper-exploit-CVE-2023-36845

CVE-2023-36845 Descripción CVE-2023-36845 representa una vulnerabilidad notable de manipulación de variables de entorno PHP que afecta a los firewalls Juniper SRX y switches EX. Aunque Juniper ha categorizado esta vulnerabilidad como de gravedad media, en este artículo explicaremos cómo esta únic...

CVE-2025-62950-PoC

Descripción Esta prueba de concepto PoC describe una vulnerabilidad de falsificación de solicitudes entre sitios Cross-Site Request Forgery, CSRF encontrada en el plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. El problema permite a un atacante engañar a un usuario...

React2Shell_cve-2025-55182

React Server Components RCE - CVE-2025-55182 ¡Hola! ¡Espero que estés teniendo un gran día! 😊✨ ¿De qué trata esto? Las versiones 19.0.0 , 19.1.0 , 19.1.1 y 19.2.0 de React Server Components tienen un grave problema de seguridad. Los paquetes react-server-dom-parcel, react-server-dom-turbopack y...

CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...