CLEANSTART-2024-PA48492 When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution

Security vulnerability affects the firefox package. When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution...

CLEANSTART-2024-EO84490 When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code

Security vulnerability affects the firefox package. When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code...

CLEANSTART-2024-QB19043 Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash

Security vulnerability affects the firefox-esr package. Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash...

CLEANSTART-2024-MU96768 By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used fo...

CVE-2021-43538 affects multiple packages. By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. See references for individual...

CVE-2026-62057

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0...

CVE-2026-52710

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in ithemelandco GIFTiT Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT Free Gifts for WooCommerce: from n/a through 4.5...

CVE-2026-118089

Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...

CLEANSTART-2024-XU78379 If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after ...

CVE-2022-22756 affects multiple packages. If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. See references for individual...

CLEANSTART-2024-DB11077 When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used

CVE-2022-28285 affects multiple packages. When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used. See references for individual vulnerability details...

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell Introduction I went into a SharePoint zero-day called ToolShell CVE-2025-53770 in the LetsDefend lab. I mimicked a real-world zero-day attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection key...

CLEANSTART-2024-HU82348 If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged co...

CVE-2022-1802 affects multiple packages. If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. See references for individual vulnerability details...

CLEANSTART-2024-NQ57975 attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tri...

Security vulnerability affects the firefox package. An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code...

CVE-2022-25581

CVE-2022-25581 Can't find it anywhere on the web, leaving a backup, Python exploit script , used to automate the following steps: ✅ Script Functionality Objectives 1. Log in to the backend obtain csrf and token 2. Construct a malicious request packet to upload a compressed archive containing a...

CLEANSTART-2024-MU54319 attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tri...

Security vulnerability affects the firefox package. An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code...

react2shell-CVE-2025-55182-full-rce-script

Next.js React2Shell CVE-2025-55182 Exploit Tool A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION This vulnerability CVSS 10.0 is being actively...

CVE-2026-78403

The Thales Sentinel Keys Server on Windows is vulnerable to an unauthenticated stack-based buffer overflow and missing authorization. The root cause is that the server fails to validate the length of the first field in an incoming HTTP request . An unauthenticated attacker can craft a malicious r...

CVE-2026-78403 Unauthenticated Stack Buffer Overflow in Sentinel Keys Server

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. ...

CVE-2026-78403 Unauthenticated Stack Buffer Overflow in Sentinel Keys Server

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. ...

EUVD-2026-114364

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. ...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 Detail Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. PoC Start a HTTP server 1- python3 -m http.server 80 Start a netcat listener 2- nc -lnvp 'Target Port' Make a request 3-...