LFiFreak

LFI Freak Features Works with Windows, Linux and OS X Includes bind and reverse shell for both Windows and Linux Written in Python 2.7 What is this all about? A unique tool for exploiting local file inclusions using PHP Input, PHP Filter and Data URI methods. Dependencies BeautifulSoup Disclaimer...

EUVD-2026-88477

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

CVE-2026-95626 Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

CVE-2015-7214

CVE-2015-7214 What is CVE-2015-7214? Please see the following link. Cross-site reading attack through data and view-source URIs Contents www/index.html SOP bypass PoC for Web local/index.html SOP bypass PoC for local Requirements Firefox version 42.0 or earlier The following is the download link ...

PDF_XSS

Payloads All The PDFs A list of crafted malicious PDF files...

EUVD-2026-68764

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and...

CVE-2026-54179 backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and...

CVE-2026-54179: Improper Neutralization of Input During Web Page Generation

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and...

mistune-patch-backport

Patch CVE-2021-1748 per iOS = 14.3 La causa principale di CVE-2021-1748 è che l'app si fida di URI di dati arbitrari e li carica in una WebView locale. Questo tweak porta indietro la patch per iOS = 14.3 intercettando l'URI data:. Si noti che esiste ancora una potente variante del bug. Questa pat...

WordPress Greenshift plugin <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Data URI vulnerability discovered by WordFence in WordPress Plugin Greenshift versions = 12.8.9...

Arbitrary File Upload

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Arbitrary File Upload via the SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only...

PT-2026-80749

Name of the Vulnerable Software and Affected Versions backpack/crud versions 6.0.0 through 6.8.13 backpack/crud versions 7.0.0 through 7.0.37 Description An authenticated administrator can store arbitrary file content on the configured disk. This occurs because the SingleBase64Image::uploadFiles...

CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

GHSA-4J8X-X6V7-W9RQ Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...

CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

CVE-2026-69264

Flowise CSVAgent is affected. Prior to 3.1.3, an attacker-controlled segment of csvFile’s data URI is interpolated into a Python source-template executed by Pyodide; due to the default js bridge to globalThis in Node.js, this can be passed to js.eval and dynamically import Node built-ins (e.g., f...