CVE-2026-58391 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filterrule.volt and natrule.volt without quote-safe encoding. The response layer uses ENTNOQUOTES, so ...

EUVD-2026-102108

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying,...

EUVD-2026-102103

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...

EUVD-2026-102096

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2020-23934

CVE-2020-23934 References 1 https://www.exploit-db.com/exploits/48636 2 https://github.com/vj0shii/PRTG-Network-MonitorCMS-Authenticated-Remote-Code-Execution/blob/master/PRTGCMS.py 3 https://stackoverflow.com/questions/12385179/how-to-send-a-multipart-form-data-with-requests-in-python 4...

EUVD-2026-102074

P4 Search formerly Helix Search allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search...

CVE-2026-110936

A vulnerability has been identified in Siemens Software Center All versions V4.0.9.8. The affected application loads dynamic-link libraries DLLs from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application...

CVE-2026-110936

A vulnerability exists in Siemens Software Center (all versions

CVE-2018-17179-OpenEMR

CVE-2018-17179-OpenEMR ⚠️ Disclaimer This repository is intended strictly for educational and research purposes only. The information and code provided here can be used in controlled environments , such as private lab machines. Unauthorized use of this code against systems you do not own or have...

CVE-2024-48427

CVE-2024-48427 Description A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manageservice&id Vulnerability Type SQL Injection Vendor of...

CVE-2022-23046

CVE-2022-23046 PHPIPAM 1.4.4 - SQLi Authenticated Orignal Exploit can be found here Original Exploit Author: Rodolfo "Inc0gbyt3" Tavares Tinker Script for CVE-2022-23046 I was having trouble getting the orginal script to run. Went ahead and tinkered with it for my use case. Used while completeing...

CVE-2026-22599

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-22599 CVE-2026-22599 Strapi 5.33.1 - Strapi I am @abraxasnull. Loopback lab. CVE-2026-22599-Abraxas-Labs.py chdirs into lab/ and runs run.sh. Content-Type Builder write API database-query injection. Yup...

OpenSTAManager-RCE-Exploit-CVE-2026-38751

OpenSTAManager RCE Exploit CVE-2026-38751 Arbitrary File Upload leading to Remote Code Execution Full-featured proof-of-concept for CVE-2026-38751 , written in Rust. Warning: This tool is intended for authorised security testing and educational purposes only. Use it only on systems you own or hav...

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

SummaryBefore Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:- POST /api/v1/build/flowid/vertices retrieveverticesorder- POST /api/v1/build/flowid/vertices/vertexid buildvertexAny...

PYSEC-2026-4309 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. Summary vLLM's disaggregated scale-out transport splits a multimodal...

CVE-2026-63314

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/adminjson.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100...

CVE-2026-63314

The WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection due to improper neutralization of input in the /webcti/admin_json.php endpoint. This flaw allows an authenticated attacker to execute SQL Injection attacks. This issue has been addressed in the IPx series version...

EUVD-2026-101951

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/adminjson.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100...