129437 matches found
CVE-2026-24167
NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosur...
CVE-2026-24168
NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A successful exploit of this vulnerability may lead to code execution, escalation of privileges and...
CVE-2016-5734-docker
CVE-2016-5734-docker PhpMyAdmin 4.0.x—4.6.2 Vulnerabilidade de Execução Remota de Código CVE-2016-5734 Configuração root@kitploit: git clone https://github.com/miko550/CVE-2016-5734-docker.git cd CVE-2016-5734-docker docker compose up hhtp://localhost:8083 Exploração root@kitploit: python3...
EUVD-2026-65588
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...
CVE-2026-75497
Webkul QloApps is susceptible to a SQL injection vulnerability caused by insufficient validation of request parameters before a database query. A remote, authenticated attacker with administrative privileges can exploit the bo_query parameter in the CustomerMessage.php file to execute crafted SQL...
CVE-2026-55585
QWED (open-source AI verification infrastructure) prior to version 5.1.2 is vulnerable to authenticated Remote Code Execution . Caller-controlled math expressions are passed directly to SymPy parse_expr() without restricted global_dict/local_dict namespaces, effectively allowing Python eval() to ...
CVE-2026-78468
FluentCRM Pro for WordPress (all versions up to and including 3.1.12 ) is vulnerable to SQL Injection caused by insufficient escaping of a user-supplied parameter and lack of sufficient preparation on an existing SQL query. An authenticated attacker with Author-level or higher access can append a...
EUVD-2026-65611
NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A successful exploit of this vulnerability may lead to code execution, escalation of privileges and...
CVE-2026-24167
NVIDIA UFM Enterprise contains a command injection vulnerability in its user management component . An authenticated administrator on an adjacent network can exploit it by sending a crafted API request , potentially leading to code execution , privilege escalation , and information disclosure . T...
EUVD-2026-65609
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...
CVE-2026-24169
NVIDIA UFM Enterprise contains a vulnerability in its plugin management API . An authenticated user with low privileges can inject code by sending a specially crafted API request. A successful exploit may lead to code execution , privilege escalation , and information disclosure . The CVSS 3.1 sc...
CVE-2026-24169
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...
CVE-2026-79773
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...
cacti-rce-snmp-options-vulnerable-application
Cacti v1.2.24 applicazione vulnerabile a iniezione di comandi autenticata CVE-2023-39362 Questa è un'applicazione vulnerabile per testare l'exploit per la vulnerabilità Cacti CVE-2023-39362. ATTENZIONE! Questa applicazione contiene gravi vulnerabilità di sicurezza. Eseguila a tuo rischio! Si...
CVE-2026-69104
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...
EUVD-2026-65531
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...
CVE-2026-79774 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...
adidnsdump
Active Directory Integrated DNS dump tool By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks. For mo...
CVE-2023-46818
CVE-2023-46818 ISPConfig - PHP कोड इंजेक्शन PoC एक्सप्लॉइट Bash परिचय ISPConfig के संस्करण = 3.2.11, /admin/languageedit.php एंडपॉइंट में records पैरामीटर के माध्यम से एक प्रमाणित PHP कोड इंजेक्शन भेद्यता के लिए संवेदनशील हैं। एक दुर्भावनापूर्ण प्रमाणित व्यवस्थापक उपयोगकर्ता इसका उपयोग करके मनमान...