281701 matches found
CVE-2026-79798
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...
CVE-2026-79799
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary...
CVE-2026-76750
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system...
CVE-2026-79794
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database...
CVE-2026-76752
Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affect...
CVE-2026-76742
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system...
DEBIAN-CVE-2026-105111
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...
drupalgeddon2-cli
drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...
CVE-2015-3224-
CVE-2015-3224- just a stupid version for CVE-2015-3224, for web console. need to setup web server for pty.py...
EUVD-2026-93972
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...
CVE-2026-101158 Security Advisory 0185
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...
EUVD-2026-93923
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404
When Gitea's web installer is reachable against a database that already contains users, such as after "INSTALLLOCK" has been reset to "false", submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying...
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404
A flaw in Gitea allows an unauthenticated remote attacker to bypass authentication via the web installer. If the installer is reachable against a database already containing users (e.g., after INSTALL_LOCK is set to false), an attacker can submit the installation form using an existing administra...
CVE-2026-106513
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...