CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-82405: Incorrect Authorization

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An...

Linux Distros Unpatched Vulnerability : CVE-2026-84990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and...

CVE-2026-92928

The OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be modified, disabled, or rotated. This design flaw, present since at least firmware 2.2.3.4 , allows an unauthenticated remote attacke...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: TastyIgniter v4.3.0 における蓄積型 XSS からアカウント乗っ取りまで 📌 概要 TastyIgniter v4.3.0 の Media Manager におけるファイルアップロード機能に、蓄積型クロスサイトスクリプティング XSS 脆弱性が確認されました。アップロードされた .svg ファイルの検証およびサニタイズが不十分であるため、認証済みの低権限ユーザーが JavaScript コードを埋め込んだ悪意のあるファイルをアップロードできます。...

CVE-2016-5195

dirtycow This exploit uses the pokemon exploit of the dirtycow vulnerability as a base and automatically generates a new passwd line. The user will be prompted for the new password when the binary is run. The original /etc/passwd file is then backed up to /tmp/passwd.bak and overwrites the root...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 Existe una vulnerabilidad de cross-site scripting XSS reflejado en múltiples URL de mooSocial v3.1.8 que permite a los atacantes robar las cookies de sesión de los usuarios y suplantar su cuenta a través de una URL manipulada. Nota: XSS también funciona cuando estas...

cachet

Cachet, the open source self-hosted status page system. Cachet 3.x Announcement For more information on the Cachet rebuild and our plans for 3.x, you can read the announcement here. Requirements PHP 8.3 or later Composer A supported database: MariaDB, MySQL, PostgreSQL or SQLite Installation,...

Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Fijación de Sesión en Vvveb CMS v1.0.6.1 Autor: Andrew Paul Fecha de Descubrimiento: 9 de junio de 2025 Vendedor: Vvveb URL del Vendedor: http://vvveb.com GitHub del Vendedor: https://github.com/givanz/Vvveb Versión Afectada: 1.0.6.1 y probablemente versiones anteriores ID CVE: CVE-2025-8517...

CVE-2024-27632

Detalles de la Vulnerabilidad CVE-2024-27632 Resumen En Savane v3.12 y anteriores, la marca de tiempo Unix se utiliza como semilla en el Generador de Números Pseudoaleatorios PRNG empleado para generar tokens de protección contra Falsificación de Solicitudes entre Sitios CSRF formid. Como...

CVE-2022-23361

Omisión de verificación móvil al registrar una nueva cuenta ------ Producto afectado JDOmni---- Todos los sitios web construidos con JDOmni son vulnerables. Este repositorio es una referencia pública para CVE-2022-23361. Esta vulnerabilidad ahora ha sido corregida por el proveedor. Conéctate...

EUVD-2026-84683

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain...

CVE-2026-75698

Adobe Connect is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user...

CVE-2026-75684

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-75697

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

EUVD-2026-84790

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page...

CVE-2026-75744

Adobe Experience Manager Forms JEE is impacted by a stored Cross-Site Scripting (XSS) vulnerability. A high-privileged attacker can inject malicious scripts into vulnerable form fields, which execute in a victim's browser upon visiting the affected page. This could result in the attacker gaining ...

EUVD-2026-84787

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-75689 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...