CVE-2026-104470 YesWiki before 4.6.7 SSRF and XSS via Bazar valeur Action

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML th...

CVE-2026-104465 YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-104465

Versions of YesWiki prior to 4.6.7 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the mail handler due to improper sanitization of the field parameter . Unauthenticated attackers can craft malicious links where a crafted field value breaks out of the aj...

EUVD-2026-91476

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

EUVD-2026-91453

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-104442

YesWiki versions prior to 4.6.7 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is the lack of input validation in the render handler's content parameter , which allows remote attackers to supply a syndication action . This enables the server to fetch arbi...

CVE-2026-104442 YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-104442 YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

EUVD-2026-91451

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

CVE-2026-104441

Versions of YesWiki prior to 4.6.7 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause lies in the {{valeur}} action's url parameter, which allows remote attackers to force the server to fetch content from arbitrary hosts and ports. By submitting the action th...

CVE-2026-85494

A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger...

CVE-2025-27136-XXE-LocalS3

CVE-2025-27136 XXE-LocalS3 Proof of Concept for CVE-2025-27136 XXE in Local-S3 └─$ python3 exploit.py http://$ip:8080 /etc/passwd + S3 service detected + Creating bucket: xxe-32d14993 + Server response: ac3aaf20-e59a-4705-9505-3ebb01db7fc1 + Retrieving file via ?location + Response:...

CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91401

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

Poc_CVE-2025-68645

CVE-2025-68645 - Zimbra Path Traversal Vulnerability 📋 Overview CVE-2025-68645 is a path traversal vulnerability in Zimbra Collaboration Suite that allows unauthenticated attackers to read arbitrary files from the server's filesystem. Vulnerable Endpoint...

IPFire_2.19_RCE_Authenticated

IPFire 2.19 OINKCODE RCE PoC IPFire 2.19 の ids.cgi ページにおける OINKCODE パラメータを介した認証を必要とするコマンドインジェクション脆弱性の Python 製概念実証 PoC です。 認可されたセキュリティテストおよびトレーニングラボのみを対象としています。 この PoC は、自分が所有しているか、明示的なテスト許可を得たシステムに対してのみ実行してください。作者は、このコードによって引き起こされた誤用や損害について一切責任を負いません。 脆弱性の概要 IPFire 2.19 は、/cgi-bin/ids.cgi...

CVE-2026-18953

CVE-2026-18953 — PoC 任意のファイル書き込みを awslabs.aws-transform-mcp-server AWS Transform MCP サーバー において、getresource ツールの savePath パラメータ経由で行うものです。 | ---|--- CVE| CVE-2026-18953 CWE| CWE-22 — 制限付きディレクトリへのパス名の不適切な制限 影響を受けるバージョン| awslabs.aws-transform-mcp-server 0.1.0 – 0.1.4 修正バージョン| 0.1.5 CVSS v3.1| 8.6 HIG...