CVE-2015-9251

CVE-2015-9251 [email protected] PoC para CVE-2015-9251 jQuery menor a 3.0.0. CVE-2015-9251 - PoC Exploit Este repositorio contiene un Proof of Concept PoC para la vulnerabilidad CVE-2015-9251 en la biblioteca jQuery. La vulnerabilidad permite un ataque de Cross-Site Scripting XSS a través de...

CVE-2026-101126

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...

CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...

CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...

CVE-2026-101126

The Joomla Extension - balbooa.com is vulnerable to file metadata tampering in Balbooa Forms versions prior to 2.4.3.4 . The root cause is that the final form submission processes JSON arrays for upload fields while only verifying that IDs are numeric. Because the application trusts client-suppli...

EUVD-2026-89098

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...

CVE-2023-44812

CVE-2023-44812 Una vulnerabilidad de cross-site scripting XSS reflejado en el parámetro adminredirecturl de la función de inicio de sesión de usuario de mooSocial v3.1.8 que permite a los atacantes robar las cookies de sesión del administrador y suplantar su cuenta mediante una URL manipulada...

CVE-2026-92371

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...

CVE-2026-92368

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...

CVE-2026-100288

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

poc-cribl-rce

Descargo de responsabilidad Esto es solo con fines informativos/educativos. Esto se ha elaborado para demostrar una inseguridad en la herramienta, de modo que el proveedor pueda verificar una corrección. Información Probado en Cribl v1.5.0 - Las versiones anteriores no se probaron, pero...

CVE-2025-52689-PoC

Código PoC de CVE-2025-52689 Código PoC para la vulnerabilidad de omisión de autenticación del punto de acceso Wi-Fi AP1361D de Alcatel-Lucent Enterprise CVE-2025-52689. Este POC fue desarrollado para la competencia SpiritCyber 2024 celebrada durante la Singapore International Cyber Week 2024. Us...

CVE-2026-100288

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

CVE-2026-100288

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

EUVD-2026-89025

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

CVE-2026-100288

Devolutions Server version 2026.3.5.0 and earlier is vulnerable to a security flaw where sensitive information is stored in cleartext within the database. An attacker who gains read access to the database can perform a direct inspection of stored records to obtain external identity provider token...

CVE-2026-92370 Remote Session Access Control Bypass Leading to Remote Code Execution

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for...

CVE-2026-92371 Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...

CVE-2026-92371 Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...

CVE-2026-92371

Prior versions of TeamViewer Full Client and Host for Linux (before version 15.82 ) are vulnerable to a Local Privilege Escalation via improper link resolution in the Cloud Session Recording (CSR) functionality. A local authenticated attacker can exploit a race condition during path validation an...