security-research

Investigación de Seguridad Vulnerabilidades que he reportado a la Apache Software Foundation, divulgadas a través del proceso de seguridad de la ASF. 46 CVE en 15 proyectos , de 2023 a 2026. Cuando existe un reproductor público, se enlaza. Cada uno es un proyecto mínimo y autocontenido que...

CVE-2026-82915 Path Traversal in Bimser Solution Software's eBA Plus

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.1...

CVE-2026-82915 Path Traversal in Bimser Solution Software's eBA Plus

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.1...

CVE-2026-82915

The eBA Plus Document and Workflow Management System by Bimser Solution Software Trade Inc. is vulnerable to a Path Traversal vulnerability. This issue affects versions from 6.7.141 before 10.0.11 . The flaw allows for improper limitation of a pathname to a restricted directory. No specific explo...

CVE-2026-85134 Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus

Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11...

CVE-2026-82969 Stored XSS in BİMSER's eBA Plus

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before...

CVE-2025-65320

CVE-2025-65320 Título Almacenamiento en texto claro de material de licencia confidencial en la memoria del proceso en Abacre Restaurant Point of Sale POS Resumen Existe una vulnerabilidad en Abacre Restaurant Point of Sale POS versiones = 15.0.0.1656 donde los datos confidenciales de licencia se...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

Cobub Razor 0.8.0 - Information Disclosure

Cobub Razor 0.8.0 is susceptible to information disclosure via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.ph...

CVE-2026-82915: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.1...

CVE-2026-101144: Improper Access Control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-101141: Improper Neutralization of Input During Web Page Generation

A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The...

CVE-2026-101145: Improper Neutralization of Special Elements used in an LDAP Query

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

CVE-2023-43147

CVE-2023-43147 Vendor: PHPJabbers Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/limo-booking-software Version: 1.0 Tested on: Windows 10 Pro Impact: Add an attacker user with admin privileges CVE: Cross Site Request Forgery vulnerability in...

CVE-2023-40868

CVE-2023-40868 Vulnerabilidad de Cross Site Request Forgery en mooSocial MooSocial Software v.Demo permite a un atacante remoto ejecutar código arbitrario mediante las funciones Eliminar Cuenta y Desactivar. La vulnerabilidad es una vulnerabilidad de Cross-Site Request Forgery CSRF en la aplicaci...

CVE-2023-40869

CVE-2023-40869 Vulnerabilidad de Cross Site Scripting en mooSocial Software v.3.1.6 y 3.1.7 permite a un atacante remoto ejecutar código arbitrario a través de un script manipulado en las funciones editmenu, copuon y groupcategorias XSS almacenado vía CSRF. Rutas Afectadas...

CVE-2021-3438

CVE-2021-3438 Un posible desbordamiento de búfer en los controladores de software de ciertos productos HP LaserJet y impresoras de productos Samsung podría provocar una escalada de privilegios...

privacytools.io

Encriptación contra la vigilancia masiva global. Contribuciones Este proyecto está archivado. Consulta nuestra publicación Bienvenido a Privacy Guides para obtener más información. Nuestro proyecto se ha trasladado a Privacy Guides. Es importante que un sitio web sobre privacidad esté actualizado...

binary-cartography

Binary Cartography Technical webinars on reverse engineering, malware analysis, and software protection. This repository hosts materials for Binary Cartography , Tim's independent webinar series on binary security. The focus is practical reverse engineering, malware analysis, and software...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...