30086 matches found
CVE-2020-8825
CVE-2020-8825 게시: CVE-2020-8825 공급업체: PHP VanillaForum 설명: 이 취약점은 사용자가 제공한 데이터가 "index.php?p=/dashboard/settings/branding" URL로 전달될 때 충분한 살균 처리가 이루어지지 않아 발생합니다. 원격 공격자는 취약한 웹사이트의 맥락에서 사용자 브라우저에 임의의 HTML 및 스크립트 코드를 영구적으로 주입하고 실행할 수 있습니다. 이 취약점을 성공적으로 악용하면 원격 공격자가 잠재적으로 민감한 정보를 탈취하고, 웹 페이지의 외형을 변경하...
CVE-2026-108264
Wizarr, a management system for media servers like Jellyfin and Plex, is vulnerable to Server-Side Template Injection (SSTI) prior to version 2026.9.1 . The issue exists because wizard step Markdown—provided via the editor or imported bundles—is evaluated in a non-sandboxed Jinja2 environment wit...
CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...
GHSA-88F6-4RJV-X774 Vikunja: TOTP secret is readable after enrollment, no step-up auth
Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...
Vikunja: TOTP secret is readable after enrollment, no step-up auth
Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...
packages_apps_settings_AOSP10_r33_CVE-2020-0416
이 저장소에는 README가 없습니다...
WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter vulnerability
Authenticated Custom+ Privilege Escalation to 'settingsdefaultwproleforcustomer' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin LatePoint versions = 5.7.3...
CVE-2020-0001
CVE-2020-0001 시스템 구성 요소를 신뢰할 수 없는 앱 프로세스에서 실행하는 POC 블로그 https://zachinio.com/blogs/cve-2020-0001 사용 방법 앱을 실행하고, 프로세스 "com.android.settings"가 존재하지 않는지 확인한 후 "서비스 시작" 버튼을 클릭합니다. 설정 앱을 실행하거나 시스템 구성 요소가 자동으로 설정 앱을 실행할 때까지 기다립니다...
packages_apps_Settings_AOSP10_r33_CVE-2020-0188_CVE-0219
이 저장소에는 README가 없습니다...
packages_apps_Settings_AOSP10_r33_CVE-2020-0219
이 저장소에는 README가 없습니다...
WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Semantic Search Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...
WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Global Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...
packages_apps_Settings_AOSP10_r33_CVE-2020-0219_CVE-2020-0188_old-one
이 저장소에는 README가 없습니다...
packages_apps_Settings_AOSP10_r33_CVE-2020-0219_CVE-2020-0188_old
このリポジトリには README がありません。...
packages_apps_Settings_AOSP10_r33_CVE-2021-0506
此存储库没有 README。...
ShaikUsaf-packages_apps_settings_AOSP10_r33_CVE-2020-0188
이 저장소에는 README가 없습니다...
CVE-2026-33272
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...
packages_apps_settings_AOSP10_r33_CVE-2020-0394
このリポジトリには README がありません。...
CVE-2026-65540
CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...