net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

CVE-2026-8838-RCE

CVE-2026-8838 — Amazon Redshift Python Driver: Remote Code Execution via eval ⚠️ Educational Use Only यह एक आक्रामक साइबर सुरक्षा अनुसंधान और प्रदर्शन परियोजना है जो विशेष रूप से शैक्षिक और जागरूकता उद्देश्यों के लिए बनाई गई है। स्पष्ट अनुमति के बिना सिस्टम पर किसी भी उपयोग को अवैध माना जाता है। इ...

fnprint

fnprint matches functions in binaries by what they do , not by what their bytes or control-flow graphs look like. it runs each function in a tiny emulator with made-up inputs, records the side effects it produces, and hashes that behavior into a fingerprint. two functions that behave the same get...

CVE-2025-47256

CVE-2025-47256 Stack overflow in LibXMP Description A stack-based buffer overflow vulnerability exists in the depackpha function of libxmp, a library for module music playback. The vulnerability is triggered when parsing malformed Pha Packer PHA module files. Improper bounds checking on a local...

functrace

functrace - एक फ़ंक्शन ट्रेसर functrace एक उपकरण है जो डायनेमिक इंस्ट्रुमेंटेशन का उपयोग करके DynamoRIO http://dynamorio.org/ के साथ एक बाइनरी फ़ाइल का विश्लेषण करने में मदद करता है। ये कुछ लागू की गई सुविधाएँ हैं DynamoRIO पर आधारित: सभी निष्पादित कोड को डिसअसेंबल करें किसी विशिष्ट फ़ंक्शन को...

CVE-2019-6446

CVE-2019-6446 تنفيذ الأوامر عبر إلغاء التسلسل في Numpy NumPy هي مكتبة Python قوية تُستخدم أساساً لإجراء العمليات الحسابية على المصفوفات متعددة الأبعاد. وفقاً لتحليلات الخبراء، فإن الإصدارات الأصغر من أو المساوية لـ 1.16.0 تحتوي على هذه الثغرة، والاقتراح للإصلاح هو حذف المعامل allowpickle من دالة...

cve-2022-22963

Spring Cloud Function SpEL - cve-2022-22963 बनाएँ root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22963.git $ cd cve-2022-22963 $ docker build . -t spring-spel-0day $ docker run -p 8080:8080 --name spring-spel-0day spring-spel-0day पेलोड root@kitploit:...

CVE-2020-1054

CVE-2020-1054 تعلّم CVE-2020-1054 Screenshot Reference https://0xeb-bp.github.io/blog/2020/06/15/cve-2020-1054-analysis.html سرقة رمز الأمان https://github.com/mwrlabs/CVE-2016-7255 تسريب دالة https://github.com/DreamoneOnly/CVE-2019-0808-32-64-exp...

ATutor-Instructor-Backup-Arbitrary-File

ATutor-Instructor-Backup-Exploit عنوان الاستغلال: ATutor 2.2.4 'النسخ الاحتياطي' تنفيذ أوامر عن بعد CVE-2019-12170 دالة بحث جوجل: inurl:/ATutor/login.php التاريخ: 5/13/2019 مؤلف الاستغلال: liquidsky Joseph McPeters الصفحة الرئيسية للبائع: https://atutor.github.io/ رابط البرنامج:...

spring-cloud-function-rce

Spring Cloud Function ثغرة حقن تعبير SPEL CVE-2022-22963 يوفر إطار Spring نموذجًا شاملاً للبرمجة والتكوين للتطبيقات المؤسسية الحديثة القائمة على java على أي نوع من منصات النشر. في إطار serverless في Spring Cloud، تقوم طريقة apply في الفئة RoutingFunction من إطار Spring Cloud Function بمعالجة معام...

CVE-2026-85040 ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040

ZhongBangKeJi CRMEB (up to 6.0.0 ) is vulnerable to OS command injection in the Custom Scheduled Task feature. The eval function in /adminapi/system/crontab/save unsafely processes the customCode argument, allowing remote attackers to inject operating-system commands. The vendor documents this as...

EUVD-2026-70314

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2023-43323

mooSocial: External HTTP and DNS Service Interaction CVE-2023-43323 mooSocial v3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. Vulerable Parameter: messageText , datawallphoto , datauserShareVideo and...

LotusCMS 3.0 - Remote Code Execution

LotusCMS 3.0 is susceptible to remote code execution via the Router function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution. id: CVE-2011-0518 info: name: LotusCMS 3.0 - Remote Code Execution author: pikpikcu...

DedeCMS 5.7 SP2 - Cross-Site Scripting

DedeCMS 5.7 SP2 is vulnerable to cross-site scripting via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php,...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-45542 info: name: MooSocial 3.1.8 - Cross-Site Scripting author...

mooSocial 3.1.8 - External Service Interaction

mooSocial 3.1.8 is vulnerable to external service interaction via multiple parameters in the post function. id: CVE-2023-43323 info: name: mooSocial 3.1.8 - External Service Interaction author: ritikchaddha severity: medium description: | mooSocial 3.1.8 is vulnerable to external service...

parisneo/lollms < 2.2.0 - Authenticated Stored XSS

parisneo/lollms 2.2.0 contains a stored XSS caused by unsanitized user input in createpost function in backend/routers/social/init.py, letting attackers inject malicious scripts executed in user browsers, exploit requires crafted post submission. id: CVE-2026-1115 info: name: parisneo/lollms 2.2....

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

Tutor LMS WordPress plugin 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. id: CVE-2026-19092...