CVE-2026-93467

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

CVE-2026-93467 HGiga｜OAKlouds - Insecure Deserialization

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

EUVD-2026-82641

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

CVE-2026-93467

CVE-2026-93467 affects OAKlouds , developed by HGiga . The vulnerability is an Insecure Deserialization flaw that allows unauthenticated remote attackers to achieve arbitrary code execution on the server by sending maliciously crafted serialized content. The assigned CVSS 3.1 score is 9.8 (CRITIC...

CVE-2026-93455

django-page-cms through 2.0.13 fails to properly validate page permissions in its admin helper views (specifically in pages/admin/views.py). This allows any staff account with low-privilege credentials to read arbitrary page content and stored media paths, enumerate content identifiers, and acces...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

openclarity

OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...

SC3010-Computer-Security

SC3010-Computer-Security — CVE-2017-5638 Attack Recreation This repository is part of the SC3010 Computer Security course project. It recreates CVE-2017-5638 , a critical Remote Code Execution vulnerability in Apache Struts 2 versions 2.3.5–2.3.31 and 2.5–2.5.10, famously exploited in the 2017...

CVE-2019-14339

CVE-2019-14339 Content Provider URI Injection on Canon PRINT 2.5.5 CVE-2019-14339. Proof of concept by @0x48piraj The ContentProvider in the Canon PRINT 2.5.5 application for Android does not properly restrict data access. This allows an attacker's malicious application to obtain sensitive...

CVE-2026-93455: Missing Authorization

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

Linux Distros Unpatched Vulnerability : CVE-2026-92475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in GPAC 26.08-DEV. This impacts the function waitforheaderandparse of the file src/utils/downloader.c. This manipulation of the...

WP < 7.1.1 - Unauthenticated Stored XSS via Comments

Description WordPress does not properly sanitise and format comment content in some cases, which could allow unauthenticated visitors to perform Stored XSS attacks against anyone viewing the post once the comment is approved...

CVE-2023-54399: Improper Neutralization of Special Elements used in an SQL Command

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

UBUNTU-CVE-2026-92475

A weakness has been identified in GPAC 26.08-DEV. This impacts the function waitforheaderandparse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and...

CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” Критическая уязвимость неаутентифицированного удаленного выполнения кода в платформе автоматизации рабочих процессов с открытым исходным кодом. 📖 Содержание Обзор Технические детали Серьезность и CVSS Затронутые версии Влияние Эксплуатация Обнаружение Исправление...

CrossSiteContentHijacking

PoC-проект межсайтового перехвата контента данных XSCH Лицензия Распространяется под лицензией AGPL см. LICENSE для получения дополнительной информации. Описание Этот проект можно использовать для демонстрации proof-of-concept PoC следующих видов атак: Эксплуатация веб-сайтов с небезопасными...

Imperva_gzip_WAF_Bypass

Imperva Web Application Firewall WAF: обход через POST-запросы Imperva Cloud WAF был уязвим к обходу, который позволяет злоумышленникам обходить правила WAF при отправке вредоносных полезных нагрузок HTTP POST, таких как эксплойты log4j, SQL-инъекции, выполнение команд, обход каталога, XXE и т. д...

burp-jq

Burp JQ Это расширение Burp для применения jq запросов к JSON-содержимому из просмотрщика HTTP-сообщений. Сборка root@kitploit: $ gradle fatJar Благодарности Burp JQ полагается на jackson-jq, Java-реализацию jq. jq jackson jackson-jq...

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public unprotected node references a protected node through a Content Picker or Multi-Node Tree Picker including those nested inside Block List,...

CVE-2026-33917_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-33917 - Уязвимость SQL-инъекции в OpenEMR Слабость CWE-89 Некорректная нейтрализация специальных элементов, используемых в SQL-команде 'SQL Injection' Продукт формирует всю или часть SQL-команды с использованием внешне влияющих входных данных от вышестоящего компонента, но не нейтрализуе...