CVE-2021-42392-exploit-lab

⚠️ H2 डेटाबेस RCE शोषण PoC CVE-2021-42392 यह रिपॉजिटरी CREATE ALIAS सुविधा का उपयोग करके H2 डेटाबेस रिमोट कोड एग्ज़ीक्यूशन भेद्यता CVE-2021-42392 का परीक्षण करने के लिए एक न्यूनतम और नियंत्रित वातावरण प्रदान करती है। कई प्रदर्शनों के विपरीत, यह शोषण H2 वेब कंसोल पर निर्भर हुए बिना सीधे H2 TCP सेवा...

CVE-2025-55182

यह एक Next.js प्रोजेक्ट है जिसे create-next-app के साथ बूटस्ट्रैप किया गया है। आरंभ करना पहले, डेवलपमेंट सर्वर चलाएँ: npm run dev or yarn dev or pnpm dev or bun dev परिणाम देखने के लिए अपने ब्राउज़र में http://localhost:3000 खोलें। आप app/page.tsx को संशोधित करके पेज को संपादित करना शुरू कर सकते...

PT-2026-104489

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-102626

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

CVE-2026-14802

CVE-2026-14802 اسم البرنامج الضعيف والإصدارات المتأثرة إصدارات create-react-app قبل 5.0.2 الوصف في نظام macOS، تسمح الدالة startBrowserProcess داخل ملف openBrowser.js من مكوّن react-dev-utils بحقن أوامر نظام التشغيل. تتيح هذه المشكلة استغلالًا عن بُعد عبر التلاعب بالدالة المحددة. التوصيات كحل مؤق...

EUVD-2026-91119

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Glpi-Project Glpi

CVE-2026-26026 — GLPI Form Dropdown SSTI PoC Authenticated SS...

CVE-2026-93882

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...

EUVD-2026-90544

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...

EUVD-2025-209819

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the createadvertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create...

PT-2026-105804

Impact The live WebSocket transport authorizes a mount via check view auth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method decoratorlogin required, name="dispatch", and custom dispatch guards...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

PT-2026-104044

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.5 Description A directory traversal flaw exists where a public-facing HTTP route handler forwards attacker-controlled paths or filenames into host file creation without boundary enforcement. This allo...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2026_0519)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260519 advisory. postgresql: CREATE STATISTICS does not check for schema CREATE privilege CVE-2025-12817 postgresql: libpq undersizes allocations, via integer wraparound...

CVE-2026-51888

The langflow-ai langflow software, specifically versions up to 1.8.4 , is vulnerable to an absolute path traversal vulnerability in the knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge_base endpoint. The root cause is a lack of boundary enforcement in src/backend/base/la...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-51888: Undefined Security Weakness

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-93882: Authorization Bypass Through User-Controlled Key

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...