CVE-2024-4879

CVE-2024-4879 Bulk scanning tool for ServiceNow CVE-2024-4879 vulnerability. Overview This tool is designed for bulk scanning of the ServiceNow CVE-2024-4879 vulnerability. It is inspired by Assetnote security research, which covers the recent ServiceNow CVE-2024-4879, CVE-2024-5178, and...

WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion

The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Plex Media Server < 1.43.3.10861 - Server Side Request Forgery

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. id: CVE-2026-96654 info: name: Plex Media Server 1.43.3.10861 - Server Side Request Forgery author:...

Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection

Team WordPress plugin = 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands. id: CVE-2025-14124 info: name: Team WordPress Plugin TLP Team = 5.0.9...

WP Data Access <= 5.5.89 - Incorrect Authorization to Privilege Escalation

The WP Data Access plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89. The plugin's write REST API endpoints wpda/app/update, wpda/app/delete, wpda/app/insert pass attacker-supplied key and val parameters...

GeoServer Demo Request Endpoint - Server Side Request Forgery

It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...

NextGen Healthcare Mirth Connect - Remote Code Execution

Unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect before version 4.4.1. id: CVE-2023-43208 info: name: NextGen Healthcare Mirth Connect - Remote Code Execution author: princechaddha severity: critical description: Unauthenticated remote code execution...

Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect

The Oracle Applications Framework component of Oracle E-Business Suite subcomponent: Popup windows lists of values, datepicker, etc. is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers...

The Green Agent POV: Formulating the Fix for an Exposed Container with Sensitive Data Access

See how the Green Agent balanced security urgency with business continuity to turn a toxic combination into an executable remediation plan and ready-to-merge pull requests...

CVE-2026-107524

Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service...

CVE-2023-30092

CVE-2023-30092 All Details about CVE-2023-30092 Software: Online Pizza Ordering System 1.0 Software Link: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html Vulnerability Type: SQL Injection Affected Component: QTY Parameter Impact Denial of Service:...

CVE-2026-107524

Dell PowerStore is affected by an integer overflow vulnerability (CWE-190). An authenticated storage host could exploit this flaw to achieve out-of-bounds data access or a denial of service . While the CVSS score reflects high impact across confidentiality, integrity, and availability, no specifi...

CVE-2026-107524

Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service...

EUVD-2026-125351

Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service...

CVE-2021-27905

CVE-2021-27905 Apache Solr ReplicationHandler Server Side Request Forgery SSRF Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and clien...

GEVAUDAN

GEVAUDAN Gluster Environment Vulnerable AUthentication Data Access & Nuke. Getting Started Gevaudan is a Red Hat GlusterFS exploit for CVEs 2018-1088 & 2018-1112. Available in both standalone and metasploit module formats. Presentations | Date| Conference| Link to Video| Link to Slides...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Summary A critical SQL Injection vulnerability was discovered in the Online Shopping System Advanced project by PuneethReddyHC. The flaw resides in action.php, which fails to properly sanitize user input from the...

CVE-2025-55575

smm-panel-sqliCVE-2025-55575 Time-based SQL Injection Detection for SMM Panel Overview This template detects a time-based SQL Injection vulnerability in the servicedetail parameter of the SMM Panel via HTTP POST requests to /ajaxdata. Exploitation can allow remote attackers to access sensitive da...

CVE-2026-126425

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through editlayout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a historydata row. Users with admin/super a...