CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery JoomGallery ≤ 4.3.0 — Editor-Role User Hijacks Any Gallery Image and Stores XSS Payload, Enabling Admin Session Takeover SUMMARY UserimageController::save in JoomGallery checks checkACL'edit', ... instead of checkACL'edit.own'...

CVE-2026-76982

Apache Wicket is vulnerable to a cross-site scripting (XSS) issue in the Button component (and its subclasses AjaxButton, AjaxFallbackButton, and WizardButton). The root cause: the Button constructor clears the escape-model-strings flag to prevent double-encoding of the value attribute on elemen...

CVE-2026-76982 Apache Wicket: XSS in Button via its model object

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

EUVD-2026-68489

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2018-6574

Este repositorio no tiene un README...

USN-8694-1 openjdk-21-crac vulnerabilities

It was discovered that the JSSE component of CRaC JDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of CRaC JDK 21 did not correctly authorize users. A remote...

USN-8693-1 openjdk-17-crac vulnerabilities

It was discovered that the JSSE component of CRaC JDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of CRaC JDK 17 did not correctly authorize users. A remote...

CVE-2024-21893.py

CVE-2024-21893 is server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. run python CVE-2024-21893.py -u...

CVE-2012-4431

¡Bienvenido a Apache Tomcat! ¿Qué es? El software Apache Tomcat® es una implementación de código abierto de las tecnologías Java Servlet, JavaServer Pages, Java Expression Language y Java WebSocket. Las especificaciones de Java Servlet, JavaServer Pages, Java Expression Language y Java WebSocket ...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

CVE-2024-45265

CVE-2024-45265 Descripción sugerida Una vulnerabilidad de inyección SQL en el componente de encuestas en SkySystem Arfa-CMS anterior a 5.1.3132 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro psid. Tipo de vulnerabilidad CWE-89 | Inyección SQL Proveedor del...

CVE-2019-3396

CVE-2019-3396...

CVE-2022-37969

CVE-2022-37969...

CVE-2025-29306_poc

Description Published: 2025-03-27 Updated: 2025-03-27 An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Usage: python testpoc.py -u http://192.168.0.1/images/index.html "id" python testpoc.py -f url.txt "id"...

CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE

CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE -orange 📋 Description CVE-2024-21182 is an unauthenticated JNDI injection vulnerability affecting the Core component of Oracle WebLogic Server. It allows a remote attacker, vi...

CVE-2023-23397

CVE-2023-23397 CVE-2023-23397 Remediation Script Powershell There are 3 PowerShell scripts. If your patch management software uses an evaluation and a remediation script , use the respective files/scripts. Alternatively, if you wish to just push out the update without the above, the All In One...

CVE-2018-8032

Axis Apache eXtensible Interaction System ------------------------------------------- ¡Bienvenido a Axis! Encontrarás documentación en el directorio docs/. Por favor, lee las notas de la versión release-notes.html en este directorio para obtener detalles sobre la versión actual. Gracias de parte...

CVE-2023-22074

CVE-2023-22074 CVE-2023-22074 vulnerabilidad en el componente de fragmentación de base de datos Oracle 19c,21c,23c https://databasesecurityninja.wordpress.com/2023/10/25/cve-2023-22074-oracle-database-password-hash-exposure-in-sharding-component/...

PoC_CVE-2025-32432

CraftCMS CVE-2025-32432 - Clean PoC Cleaned-up and improved version of the original Proof of Concept. Credits Original research: Orange Cyberdefense & Chirag Artani Cleaned-up and improved version: n40y License This project is licensed under MIT. See the LICENSE file for more details. Disclaimer...

Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request. id: CVE-2018-6605 info: name: Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection author: DhiyaneshDk severity...