CVE-2024-22641

CVE-2024-22641 Type de vulnérabilité Déni de service par expression régulière ReDoS Produit et version concernés TCPDF AddPage; $pdf-ImageSVG$file='poc.svg'; ? Remarque : La vérification avec preglasterror après la ligne de code vulnérable fera sortir l'expression régulière avec...

CVE-2025-63915-There-is-a-Reflected-xss-vulnerability-exists-in-DoraCMS

CVE-2025-63915 Cible:https://www.html-js.cn Github:https://github.com/doramart/DoraCMS Version:V2.1.8 Nom de la vulnérabilité : Vulnérabilité de Cross-Site Scripting Réfléchi XSS dans DoraCMS V2.1.8 CWE-79 Type de vulnérabilité : Cross-Site Scripting Réfléchi XSS Réfléchi Date de découverte :...

CVE-2021-40303

CVE-2021-40303 perfex crm 1.10 est vulnérable à un Cross Site Scripting XSS stocké via /clients/profile. poc: POST /clients/profile HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept:...

EEF-CVE-2026-88257 beam_mcp: nested tool argument constraints advertised but not enforced

Summary Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beammcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and...

EUVD-2026-94980

Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beammcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric...

CVE-2026-88257

The beam_mcp library (versions 0.1.0 before 0.10.1 ) contains an Improper Input Validation vulnerability in BeamMCP.Schema . The validate/2 function only enforces constraints (type, required, enum, and numeric bounds) on top-level arguments. Consequently, nested objects and array items lack enfor...

elfloader

Summary elfloader is a super simple loader for ELF files that generates a flat in-memory representation of the ELF. Pair this with Rust and now you can write your shellcode in a proper, safe, high-level language. Any target that LLVM can target can be used, including custom target specifications...

CVE-2026-27420

The Katie Seaborn Zotpress WordPress plugin (versions n/a through 7.4.4 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to Improper Neutralization of Input During Web Page Generation . This vulnerability allows an attacker to execute malicious scripts in the context of a user's br...

EUVD-2026-94968

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4...

CVE-2025-56762

Description : L'application utilise "error.php" pour renvoyer le code d'erreur correspondant au cas d'usage vers l'application web lorsqu'une erreur survient. Lors de l'inspection du code source, il a été constaté que l'application ne nettoie pas le paramètre "code" lors de la construction d'un...

CVE-2026-16178

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation...

CVE-2015-1427

CVE-2015-1427 الخيارات -u رابط واحد -l تحديد ملف عناوين URL -c تحديد الأمر...

CVE-2014-0472

CVE-2014-0472 Utilisez docker-compose up -d Accédez à localhost:8083 Référence : https://www.djangoproject.com/weblog/2014/apr/21/security/ 1. Une ou plusieurs vues sont présentes et construisent une URL basée sur une entrée utilisateur généralement, un paramètre « next » dans une chaîne de requê...

CVE-2021-21234

CVE-2021-21234 CVE-2021-21234 Spring Boot Répertoire traversé spring-boot-actuator-logview ajoute un simple visualiseur de fichiers journaux en tant que point de terminaison d'actuateur Spring Boot. Il s'agit du package Maven « eu.hinsch:spring-boot-actuator-logview ». Dans les versions antérieur...

EUVD-2026-94889

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation...

CVE-2026-16178

The IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to a denial of service attack. This is caused by improper input validation which can lead to an out-of-bounds write (CWE-787). A remote at...

CVE-2021-21985

CVE-2021-21985 يحتوي عميل vSphere HTML5 على ثغرة تنفيذ تعليمات برمجية عن بُعد بسبب عدم التحقق من صحة الإدخال في المكون الإضافي Virtual SAN Health Check الذي يتم تمكينه افتراضيًا في vCenter Server. قامت VMware بتقييم خطورة هذه المشكلة لتكون في نطاق الخطورة الحرجة مع حد أقصى للدرجة الأساسية CVSSv3...

CVE-2026-105890 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12...

CVE-2026-105078 WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP Store Locator: from n/a through 3.0.3...

CVE-2019-12453

CVE-2019-12453 CVE-2019-12453 XSS مخزنة في MicroStrategy Web قبل الإصدار 10.1 التصحيح 10 المؤلف: undefinedmode https://github.com/undefinedmode/CVE-2019-12453 في MicroStrategy Web قبل الإصدار 10.1 التصحيح 10، يمكن حدوث XSS مخزنة في معامل FLTB بسبب عدم التحقق من صحة الإدخال. يُستخدم معامل FLTB في...