CVE-2026-108110

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

save-pixels-updated

यह save-pixels का एक अद्यतन संस्करण है जो CVE-2020-8175 सुरक्षा समस्या को ठीक करता है। निर्माण के समय, package.json को छोड़कर प्रत्येक फ़ाइल मूल भंडार की फ़ाइलों के समान है। save-pixels-updated निम्नलिखित save-pixels GitHub पृष्ठ से है। जैसा कि पहले उल्लेख किया गया है, इस भंडार में कोई ब्रेकिंग...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

CVE-2026-37067

CVE-2026-37067 वेनो फ़ाइल मैनेजर प्रोजेक्ट 4.4.9 में /vfm-admin/admin-panel/view/save-cvs.php में गलत पहुँच नियंत्रण एक अप्रमाणित हमलावर को एक विशेष रूप से तैयार POST अनुरोध के माध्यम से एक वांछित तिथि से आगे के सभी एप्लिकेशन लॉग निकालने की अनुमति देता है।...

session_reaper_lab

CVE-2025-54236 - SessionReaper प्रयोगशाला CVE-2025-54236 SessionReaper के व्यावहारिक प्रदर्शन हेतु Docker वातावरण: PHP ऑब्जेक्ट डिसीरियलाइज़ेशन जो Magento Open Source 2.4.7 में RCE की ओर ले जाता है। केवल नियंत्रित वातावरण में उपयोग हेतु। स्पष्ट अनुमति के बिना सिस्टम के विरुद्ध न चलाएं। भेद्यता के...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

EUVD-2026-95349

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-107792

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-107792 Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-107792

The Jivejdon software (from commit d58a36b0 through ee67a65e ) is vulnerable to a missing authorization flaw within the UpdateThreadToForumAction component. This vulnerability allows authenticated users to relocate reply-less threads to arbitrary forums by sending crafted threadId and forumId val...

CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — مختبر تصعيد الصلاحيات المُوثَّق في WooCommerce Wholesale Prices نظرة عامة هذا المشروع عبارة عن مختبر Docker محلي لتحليل وإعادة إنتاج سلوك CVE-2026-27541 في إضافة WooCommerce Wholesale Prices / Wholesale Suite من خلال مقارنة الإصدارات الهشّة والمُصحَّحة جنبًا إلى جنب على نفس الجها...

CVE-2023-51385-save

لا يحتوي هذا المستودع على ملف README...

CVE-2021-21123-PoC-Google-Chrome

📝 विवरण Google Chrome - File System Access API - Maciej Pulikowski द्वारा रिपोर्ट की गई कमज़ोरियाँ कुल बग बाउंटी पुरस्कार: $5.000 यह निम्नलिखित के लिए प्रूफ ऑफ कॉन्सेप्ट है: Google SecuritySeverity CVE HIGH CVE-2021-21123 MEDIUM CVE-2021-21129 MEDIUM CVE-2021-21130 MEDIUM CVE-2021-21131 MEDIUM...

docker-socket-risk-demos

docker-socket-risk-demos المستودع المرافق للفيديو: Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — inspired by CVE-2026-33634 https://www.youtube.com/watch?v=xLTYzfPY3xI يحتوي هذا المستودع على تطبيق الويب النموذجي وموجه Claude Code المستخدمين في الفيديو لتوضيح: 1. لماذا يم...

Craft-CMS-3.0.25---Cross-Site-Scripting

Craft-CMS-3.0.25 - البرمجة النصية عبر المواقع XSS Craft CMS 3.0.25 - ثغرة البرمجة النصية عبر المواقع CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 إثبات المفهوم يتيح تنفيذ هجوم البرمجة النصية عبر المواقع XSS عن طريق حفظ عنوان جديد من تبويب وحدة التحكم. POST...

CVE-2024-54819

CVE-2024-54819 अधिक विवरण के लिए देखें: https://www.partywave.site about CVE-2024-54819 लॉगिन के लिए POST अनुरोध हमलावर को लॉग इन होना चाहिए POST /librarian/index.php/authentication HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:128.0 Gecko/20100101 Firefox/128.0 removed...

CVE-2026-107175

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...