CVE-2023-1454

CVE-2023-1454 CVE-2023-1454 Vulnerability Detection Script This article is for reference only. Do not use the technical materials and tools in this article to intrude into any computer system without authorization. The direct or indirect consequences and losses caused by the information provided ...

CVE-2026-101785

A flaw was found in the MySQL Server JSON component. An authenticated remote attacker with low privileges can exploit this vulnerability over network protocols to modify, create, or delete accessible database records. Successful exploitation can also result in a Denial of Service DoS by crashing ...

CVE-2026-114646

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

CVE-2026-114646 NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

CVE-2026-114646

A data-validation flaw in the MongoDB C# Driver affects the BSON handling and binary serialization path. When an application constructs a raw or lazy BSON document from externally supplied binary data, the driver fails to verify if the declared size quantity matches the actual data provided. This...

EUVD-2026-108310

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

CVE-2024-8465-PoC

CVE-2024-8465 – SQL Injection Proof of Concept Team Information Team Name: The Misfits Team Members: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Overview This repository contains a vulnerable web application created as a Proof of Concept PoC to demonstrate an SQL...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – SQL Injection Proof of Concept Team Information Team Name: The Misfits Team Members: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Overview This repository contains a vulnerable web application created as a Proof of Concept PoC to demonstrate an SQL...

CVE-2026-101781

A flaw was found in MySQL's Group Replication Group Communication System GCS. An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQ...

EUVD-2026-107892

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerability found and tested in Anteeo WMS - v4.7.31 The vulnerability allows threat actors to craft an SQL command inside the username parameter and disclose data in the underlying database. The impacted versions of ANTEEO B2B WMS are from v.4.7.x to v.4.7.34 excluded. Usage...

EUVD-2026-107660

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedulesearch capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language SPL commands that disclose or alter...

CVE-2026-76291

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedulesearch capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language SPL commands that disclose or alter...

CVE-2026-76291 Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedulesearch capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language SPL commands that disclose or alter...

CVE-2026-76291

Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are vulnerable to an improper access control issue. A user with the schedule_search capability can bypass safeguards in the scheduled search workflow because the search scheduler fails to apply SPL safeguards for risky commands....

CVE-2026-113297

A flaw was found in the Ozone component of Chromium. An improper access control issue allows a remote attacker to obtain sensitive information by convincing a user to visit a specially crafted HTML page. Successful exploitation may lead to unauthorized data disclosure...

CVE-2026-87293

A flaw was found in OpenJDK's Remote Method Invocation RMI component. An unauthenticated remote attacker can exploit this vulnerability by sending crafted data to exposed application programming interfaces APIs. Successful exploitation allows unauthorized modification, deletion, or disclosure of...

CVE-2021-2471

CVE-2021-2471 - XXE in MySQL Connector/J Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.26 and prior. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access ...

CVE-2026-92999 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...