CVE-2026-1405

CVE-2026-1405 Slider Future = 1.0.5 - Unauthenticated Arbitrary File Upload 🚀 CVE-2026-1405.py — Slider Future Mass Exploit Tool 🩸 Vulnerability Overview Component: Slider Future WordPress plugin Affected Versions: ≤ 1.0.5 Vulnerability: Unauthenticated Arbitrary File Upload CVE: CVE-2026-1405 CV...

pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

A flaw was found in Pillow. When saving compressed Tagged Image File Format TIFF images into memory buffers rather than direct files, the library incorrectly calculates the required memory allocation. A remote attacker who supplies a crafted image for processing can trigger a heap-based buffer...

pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

A flaw was found in Pillow. A remote attacker can achieve arbitrary code execution by supplying a specially crafted FlashPix FPX image file to an application that processes untrusted inputs. Due to improper handling of image tile data during JPEG decoding, the library writes pixel data beyond the...

CVE-2025-3248

Technical Analysis & Defensive Guide: CVE-2025-3248 Langflow Code Injection An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow. 📌 Vulnerability Profile CVE ID: CVE-2025-3248 Vulnerability Type: Remote Code Execution RCE /...

CLEANSTART-2024-PA48492 When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution

Security vulnerability affects the firefox package. When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution...

CLEANSTART-2024-EO84490 When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code

Security vulnerability affects the firefox package. When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code...

CLEANSTART-2024-QB19043 Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash

Security vulnerability affects the firefox-esr package. Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash...

CLEANSTART-2024-MU96768 By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used fo...

CVE-2021-43538 affects multiple packages. By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. See references for individual...

CVE-2026-62057

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0...

CVE-2026-52710

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in ithemelandco GIFTiT Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT Free Gifts for WooCommerce: from n/a through 4.5...

CVE-2026-118089

Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...

CLEANSTART-2024-XU78379 If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after ...

CVE-2022-22756 affects multiple packages. If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. See references for individual...

CLEANSTART-2024-DB11077 When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used

CVE-2022-28285 affects multiple packages. When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used. See references for individual vulnerability details...

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell

LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell Introduction I went into a SharePoint zero-day called ToolShell CVE-2025-53770 in the LetsDefend lab. I mimicked a real-world zero-day attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection key...

CLEANSTART-2024-HU82348 If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged co...

CVE-2022-1802 affects multiple packages. If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. See references for individual vulnerability details...

CLEANSTART-2024-NQ57975 attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tri...

Security vulnerability affects the firefox package. An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code...

CVE-2022-25581

CVE-2022-25581 Can't find it anywhere on the web, leaving a backup, Python exploit script , used to automate the following steps: ✅ Script Functionality Objectives 1. Log in to the backend obtain csrf and token 2. Construct a malicious request packet to upload a compressed archive containing a...

CLEANSTART-2024-MU54319 attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tri...

Security vulnerability affects the firefox package. An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code...

react2shell-CVE-2025-55182-full-rce-script

Next.js React2Shell CVE-2025-55182 Exploit Tool A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION This vulnerability CVSS 10.0 is being actively...

CVE-2026-78403

The Thales Sentinel Keys Server on Windows is vulnerable to an unauthenticated stack-based buffer overflow and missing authorization. The root cause is that the server fails to validate the length of the first field in an incoming HTTP request . An unauthenticated attacker can craft a malicious r...