CVE-2023-7028-Docker

CVE-2023-7028 con Docker 🎯 ¿Quieres practicar con la nueva CVE de Gitlab? Sigue las instrucciones Construye el laboratorio 1. Instala Docker : https://docs.docker.com/get-docker/ 2. Clona el proyecto : git clone https://github.com/Trackflaw/CVE-2023-7028-Docker.git. 3. Ve al proyecto : cd...

kirki-wordpress-account-security-assessment

CVE-2026-8206 - Toma de control de cuentas no autenticada en el plugin Kirki de WordPress Informe de ciberseguridad estilo consultoría Informe profesional de evaluación de vulnerabilidades sobre el riesgo de seguridad de las cuentas de Kirki en WordPress, que incluye el impacto técnico, la...

CVE-2024-57373

Vulnerabilidad CSRF en LifestyleStore v1.0 📌 Resumen Este repositorio documenta una vulnerabilidad de Cross-Site Request Forgery CSRF identificada en el proyecto LifestyleStore v1.0. La falla permite a los atacantes realizar acciones no autorizadas en nombre de los usuarios autenticados, lo que...

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

Microweber < 1.2.17 - Cross-Site Scripting

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. id: CVE-2022-2130 info: name: Microweber 1.2.17 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS vulnerability in the...

EUVD-2026-92597

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-100102 RCE via exposed JDWP debug agent in P4Search

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server...

CVE-2026-105641: Use of Hard-coded Credentials

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-104461

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

EUVD-2026-91472

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-104461

YesWiki versions prior to 4.6.7 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the Bazar FileField . The root cause is that the application validates only the file extension during upload and fails to call HtmlPurifierService::cleanFile, allowing SVG files to be stored ver...

CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

Exploit for CVE-2026-94541

CVE-2026-94541 — WPMobile.App Table of Contents - Execut...

CVE-2026-104461: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

PT-2026-104271

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNKCondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the mediaIsInUse function. An attacker can execute arbitrary JavaScript in the context of an administrator's browser session by injecting malicious payloads into the type name field, which are rendered...

Linux Distros Unpatched Vulnerability : CVE-2026-84990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and...