Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro: неаутентифицированная загрузка файла с RCE Расширенные отзывы → saveattachments → Пользовательские шрифты: обход strpos → shell.woff2.php Обзор CVE-2026-58480 также известный как CVE-2026-15158 — это критическая CVSS 9.8 уязвимость неаутентифицированной...

CVE-2024-23700

PoC для CVE-2024-23700, позволяющий незаметно получать разрешения на чтение/запись контактов, SMS, календаря, журнала вызовов и голосовой почты, совершать исходящие вызовы или отвечать на входящие, изменять настройки вызовов, получать доступ к уведомлениям других приложений и управлять ими,...

CVE-2026-84811

agentverus-scanner (a security scanning tool for code analysis) fails to analyze compiled Python bytecode files in companion code directories, enabling a security scanning bypass . Attackers can ship malicious __pycache__ entries alongside benign source files, causing arbitrary Python bytecode to...

CVE-2024-9707-Poc

CVE-2024-9707-Poc 🌐 Описание Этот скрипт эксплуатирует уязвимость в плагине WordPress Hunk Companion CVE-2024-9707, позволяя неавторизованным злоумышленникам устанавливать и активировать произвольные плагины через конечную точку /wp-json/hc/v1/themehunk-import REST API. Функции...

CVE-2024-11972-PoC

CVE-2024-11972-PoC Hunk Companion 1.9.0 - Неаутентифицированная установка плагина Описание Плагин Hunk Companion для WordPress до версии 1.9.0 некорректно авторизует некоторые конечные точки REST API, что позволяет неаутентифицированным запросам устанавливать и активировать произвольные плагины...

Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to...

Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-1780 info: name: Companion Sitemap Generator 4.5.3 - Cross-Site Scripting author:...

CVE-2023-22524

Preuve de concept de vulnérabilité RCE dans Atlassian Companion CVE-2023-22524 Aperçu Ce dépôt contient une preuve de concept PoC pour la vulnérabilité d'exécution de code à distance récemment découverte dans Atlassian Companion pour macOS, identifiée sous le nom CVE-2023-22524. Ce problème...

CVE-2024-34463

CVE-2024-34463 영향받는 장치 : BPL Smart Weighing Scale PWS-01-BT https://www.bplmedicaltechnologies.com/product-details/weighing-scales/personal-weighing-scale-pws-01bt/ 취약점 : 디지털 체중계와 관련 앱 https://bpl-bewell.en.aptoide.com/app 간 Bluetooth 통신의 보안 부족 협력자 : Hanit Thakur 익스플로잇 실행 단계 아직 설치되지 않았다면...

CVE-2023-22524

Atlassian Companion RCE 취약점 개념 증명 CVE-2023-22524 개요 이 저장소는 macOS용 Atlassian Companion에서 최근 발견된 원격 코드 실행 취약점CVE-2023-22524에 대한 개념 증명PoC을 포함합니다. 이 심각한 문제는 공격자가 앱의 차단 목록과 macOS Gatekeeper를 우회하여 유해한 코드를 실행할 수 있게 합니다. 세부 정보 이 취약점은 특정 파일 형식에 대한 애플리케이션의 처리와 macOS 보안 기능과의 상호 작용에서 발생한 간과로 인해 발생합니다. 취약점의 발...

CVE-2023-41898_Lab

CVE-2023-41898 Unvalidated Deep Link Lab Это учебная лаборатория уменьшенного воспроизведения, созданная на основе публичного отчёта об уязвимости GHSL-2023-142 Home Assistant Companion for Android и структуры исходного кода уязвимой версии 2023.8.2. Реальные сервер, учётная запись и токены Home...

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

The plugin does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary plugins from the WordPress.org repo, including vulnerable plugins that have been closed. id: CVE-2024-11972 info: name: Hunk Companion 1.9.0 - Unauthenticated Plugi...

CVE-2024-11972-POC

Description Nom : CVE-2024-11972 Score CVSSv3 : 9.8 Versions affectées : Hunk Companion argparse, requests, urljoin...

CVE-2026-18488

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488

The Blocksy Companion WordPress plugin (versions up to and including 2.1.51 ) is vulnerable to authenticated Stored XSS via the tagName block attribute in the blocksy/dynamic-data block, caused by insufficient input sanitization and output escaping. Attackers with Author-level access or higher ca...

EUVD-2026-68987

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

WordPress Blocksy Companion plugin <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data vulnerability discovered by haofanjiukunle in WordPress Plugin Blocksy Companion versions = 2.1.51...

Code-27-Companion-Hub-Exploits

Уязвимости Code 27 3D Companion Hub CVE-2026-36027, CVE-2026-36028 Code 27 3D Companion Hub — это физическое настольное устройство, отображающее пользовательского ИИ-персонажа «Коди» в виде анимированного 3D-компаньона. Пользователи могут загружать или создавать любые 3D-модели, а мультимодальный...