Microweber < 1.2.17 - Cross-Site Scripting

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. id: CVE-2022-2130 info: name: Microweber 1.2.17 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS vulnerability in the...

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

CVE-2024-57373

CSRF Vulnerability in LifestyleStore v1.0 📌 Overview This repository documents a Cross-Site Request Forgery CSRF vulnerability identified in the LifestyleStore v1.0 project. The flaw allows attackers to perform unauthorized actions on behalf of authenticated users, posing risks to data integrity...

CVE-2026-61719

Prior to version 3.8.7 , the WeGIA web manager for charitable institutions is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of proper sanitization in the textoProntuario field within saude/historico_prontuarios.php. An attacker with permissions to create or access p...

CVE-2023-7028-Docker

CVE-2023-7028 with Docker 🎯 Want to practice with the new gitlab CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2023-7028-Docker.git. 3. Go to the project : cd CVE-2023-7028-Dock...

kirki-wordpress-account-security-assessment

CVE-2026-8206 - Kirki WordPress Plugin Unauthenticated Account Takeover Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Kirki WordPress account security risk, including technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind...

CVE-2026-115748

A flaw was found in Apache Vysper. Its implementation of Extensible Messaging and Presence Protocol XMPP In-Band Registration lacks an authentication check. An authenticated remote attacker can exploit this vulnerability to compromise other user accounts on the server...

CVE-2026-115748

UNSUPPORTED WHEN ASSIGNED Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP Jabber server library. Its XEP-0077 In-Band Registration implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is...

CVE-2026-115748

Apache Vysper, an XMPP (Jabber) server library, is vulnerable to an authorization bypass in all versions. The issue stems from the XEP-0077 (In-Band Registration) implementation, which lacks a necessary authentication check. This allows any authenticated user to compromise other accounts . Becaus...

CVE-2026-115748 Apache Vysper: Authorization bypass

UNSUPPORTED WHEN ASSIGNED Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP Jabber server library. Its XEP-0077 In-Band Registration implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is...

EUVD-2026-109916

UNSUPPORTED WHEN ASSIGNED Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP Jabber server library. Its XEP-0077 In-Band Registration implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is...

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle AitM relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between...

PT-2026-123389

UNSUPPORTED WHEN ASSIGNED Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP Jabber server library. Its XEP-0077 In-Band Registration implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is...

ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't...

CVE-2026-67165

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

PT-2026-111307

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

EUVD-2026-92597

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-100102 RCE via exposed JDWP debug agent in P4Search

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server...

CVE-2026-105641: Use of Hard-coded Credentials

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...