94 matches found
CVE-2024-10629
🛠️ GPX Viewer 漏洞利用 CVE-2024-10629 该仓库包含针对 WordPress 的 GPX Viewer 插件的概念验证漏洞利用代码，该插件存在任意文件创建漏洞（CVE-2024-10629）。该漏洞允许具有订阅者级别及以上访问权限的已认证攻击者在受影响站点的服务器上创建任意文件，从而可能导致远程代码执行。 📝 CVE 详情 CVE ID : CVE-2024-10629 发布日期 : 2024-11-13 更新日期 : 2024-11-13 受影响插件 : GPX Viewer -un -p 将 、 和 替换为相应的值。 示例 root@kitploit:...
CVE-2024-10629
CVE-2024-10629 GPX Viewer = 2.2.8 - 認証済み（Subscriber+）任意ファイル作成 説明: WordPress用GPX Viewerプラグインは、バージョン2.2.8まで（同バージョンを含む）のすべてのバージョンにおいて、gpxvfileupload関数の権限チェックとファイルタイプ検証が欠如しているため、任意のファイル作成が可能です。これにより、購読者レベル以上のアクセス権を持つ認証済み攻撃者が、影響を受けるサイトのサーバー上に任意のファイルを作成し、リモートコード実行が可能になる可能性があります。 root@kitploit: Publishe...
MINI-H6PF-9GPX-J282
Bulletin has no description...
XML Injection
Overview Affected versions of this package are vulnerable to XML Injection in the KML and GPX export functionality. An attacker can corrupt the file structure and spoof exported location data by creating a device with a crafted name that injects XML content into the exported files. Remediation...
CVE-2026-27693
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML...
EUVD-2026-27307
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML...
CVE-2026-27693 traccar allows XML injection in KML and GPX exports
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML...
CVE-2026-27693 traccar allows XML injection in KML and GPX exports
Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML...
CVE-2026-27693
CVE-2026-27693 affects Traccar (org.traccar:traccar) versions 6.11.1–
NordicTrackExploit
QZCompanionNordictrackTreadmill Companion App of QZ for Nordic...
GHSA-JQMR-2PG9-VFX7 Apache SIS has Improper Restriction of XML External Entity Reference vulnerability
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the...
CVE-2025-68280
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the...
CVE-2025-68280 Apache SIS: XML External Entity (XXE) vulnerability
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the...
EUVD-2012-5922
Malware in sbrugna...
EUVD-2025-11633
Malicious code in bioql PyPI...
EUVD-2024-49673
Malicious code in bioql PyPI...
EUVD-2023-48593
Malicious code in bioql PyPI...
EUVD-2025-5603
Malicious code in bioql PyPI...
CVE-2024-9028
The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sgpx' shortcode in all versions up to, and including, 1.7.08 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...