707 matches found
public-pentesting-reports
Public penetration testing reports A repository containing public penetration test reports published by consulting firms and academic security groups. Maintained by Julio @ Blaze Information Security https://www.blazeinfosec.com. Based on a list started in 2015 by Arne Padmos. See this repo for a...
CVE-2026-106933
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in th...
CVE-2026-106933 Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in th...
CVE-2026-106933
The Blaze Demo Importer WordPress plugin, in versions prior to 1.0.17 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to sanitize uploaded SVG files and the unconditional registration of the SVG MIME type for the WordPress media library. This allows authen...
EUVD-2026-104083
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in th...
WordPress Blaze Demo Importer plugin < 1.0.17 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Luis Schlegel in WordPress Plugin Blaze Demo Importer versions 1.0.17...
CVE-2026-106933 Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in th...
CVE-2026-106933: Improper Neutralization of Input During Web Page Generation
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in th...
PT-2026-117230
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in th...
Thunderstorm
Thunderstorm Non hai 4.000 finding. Hai sei percorsi verso i tuoi gioielli della corona. Un CSPM ti consegna una lista piatta, deduplicata e ordinata per severità di misconfigurazioni e ti lascia indovinare quali contano. Thunderstorm ragiona sulla raggiungibilità : raccoglie il tuo cloud in sola...
Malicious code in lint-staged-blaze-concurrently-cordelia (npm)
Source: amazon-inspector c264da9ee153bfc81c5d7023d782b5e52b2e8e8b64216fe7ac06aa6fdb1d3df8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in library-blaze-heka-lint (npm)
Source: amazon-inspector d51b8af5044f50a93459386244d570c089c10f5bcba81f155c01e484f9c28712 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in less-loader-sedna-blaze-commitizen (npm)
Source: amazon-inspector a0aed9d31de0bbd2811f97f41f0bf00007a65a06d53fe4bd3a25fd061d296763 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in koa-postgres-blaze-electron (npm)
Source: amazon-inspector 5b6cdae761bee4ee4e8ae8294fde8b8c4d62a37e14f8b704bf9fa3dee5d856c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kaus-socketio-blaze-betelgeuse (npm)
Source: amazon-inspector a271214cea16cd84986d48c937872fb750393b1a48276a7270a1c97950bf70f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kastra-run-script-firebase-blaze (npm)
Source: amazon-inspector fc401c10920d96d579d2722526875bac5f60943ac975fdf0410ecc87dc3389e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in juno-blaze-rehype-cz-conventional-changelog (npm)
Source: amazon-inspector e6241065b09716af75551dbb5e650737a8310ebea79da1f6bc7c1d4c078ba7d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in json-blaze-venus-antd (npm)
Source: amazon-inspector d51c1c6ec63a3d99da75baa6514564df1e94d76b8d4233dc509033894f4ee415 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in jovian-mira-blaze-prompts (npm)
Source: amazon-inspector 2d7a31a0701b775544671d1d8f873a6e0cfd3eac66a6004ec3924bbdd70f5eca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-69209
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that...