11413 matches found
CVE-2025-31125
Exploit CVE-2025-31125 - Path Traversal de Importação WASM no Vite 🛡️ Este script é um exploit prova de conceito PoC para CVE-2025-31125 , uma vulnerabilidade encontrada no Vite. O exploit utiliza um problema de Path Traversal de Importação WASM para recuperar arquivos confidenciais de servidores...
CVE-2026-33137
CVE-2026-33137 XWiki Platform – Nicht authentifizierter XAR-Import via REST/wikis/wikiName Beschreibung Der REST-API-Endpunkt POST /wikis/wikiName in der XWiki-Plattform führt einen XAR-Import XWiki-Archiv durch, ohne dabei eine Authentifizierungs- oder Autorisierungsprüfung vorzunehmen. Ein nich...
CVE-2026-76547
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...
CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...
CVE-2026-80488
WP Ultimate CSV Importer WordPress plugin versions before 9.0 contain a SQL injection vulnerability in the AIOSEO Import Fields feature. Imported field values are not properly sanitised or escaped before being used in a SQL statement, allowing high-privilege users (admin and above) to execute arb...
CVE-2026-76547
CVE-2026-76547 affects the User Profile Builder WordPress plugin before version 4.0.1 . The root cause is unvalidated deserialization when importing a configuration file, enabling PHP Object Injection by high-privilege users (e.g., administrators). Two significant mitigating factors reduce practi...
EUVD-2026-68051
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...
CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...
IATelligence
IATelligence IATelligence è uno script Python che estrae la Import Address Table IAT da un file PE e usa il modello GPT-3 di OpenAI per fornire dettagli su ogni API Windows importata dal file. Lo script cerca anche le tecniche MITRE ATT&CK correlate e spiega come l'API potrebbe essere...
CVE-2025-11170
CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - Caricamento Arbitrario di File non Autenticato 🚀 WP移行専用プラグイン for CPI = 1.0.2 - Caricamento Arbitrario di File non Autenticato 📝 Descrizione Il plugin WP移行専用プラグイン for CPI per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancanza...
PT-2026-83429
Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...
packer-tutorial
Inhaltsverzeichnis 1. Was ist ein Packer? : Eine Einführung in den Zweck von Packern und ein Leitfaden durch die Entwicklungserfordernisse eines Packers. 2. Voraussetzungen : Werkzeuge, die du für dieses Tutorial benötigst. 3. Ein Vorgeschmack : Eine Demonstration dessen, was du mit diesem Tutori...
CVE-2026-55247
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...
CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...
plone.app.event vulnerable to denial of service via iCalendar import
Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...
EUVD-2026-67868
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...
CVE-2026-55247 plone.app.event: Denial of service via iCalendar import
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...
CVE-2026-55247
plone.app.event , Plone's event content type, contains multiple issues in its iCalendar import (src/plone/app/event/ical/importer.py) prior to versions 5.2.4 and 6.0.1 . The importer accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported ...
CVE-2026-55247 plone.app.event: Denial of service via iCalendar import
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...