The vulnerability of the platform for creating individual web applications in CRM involves a lack of measures to protect the SQL query structure, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the Directum RX ECM system, related to deficiencies in access control, allows a perpetrator to compromise data integrity.

The vulnerability of the Directum RX ECM system is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

RISE-Ultimate_Project_Manager_e_CRM

CVE-2025-3855 - RISE Ultimate Project Manager - IDOR セキュリティ脆弱性: IDOR（安全でない直接オブジェクト参照） 影響を受けるコンポーネント: プロフィール画像アップロードエンドポイント、teammembers コントローラー ソフトウェア: RISE - Ultimate Project Manager & CRM ベンダー: codecanyon バージョン: 3.8.2 CVE ORG : https://vulners.com/cve/CVE-2025-3855 NIST:...

BLE-TPMS

CVE-2024-39081 リンク: https://vulners.com/cve/CVE-2024-39081 BLEベースのTREEL TPMS（自転車向け） ここでは、Bluetooth経由でのTPMSデータ操作を実行し、説明しました。Bluetooth経由でアプリユーザーに誤報を送信できます。詳細な脆弱性の発見と分析はリポジトリに保存されています。 ファイル名 - https://github.com/Amirasaiyad/BLE-TPMS/blob/main/TreelBLETPMSPenetrationTestingReport.pdf 製品について TREEL...

CVE-2024-41302-Bookea-tu-Mesa-is-vulnerable-to-SQL-Injection

CVE-2024-41302-Bookea-tu-Mesa-is-vulnerable-to-SQL-Injection- Bookea-tu-Mesa は SQL インジェクション SQLi の脆弱性の影響を受けます。この欠陥により、攻撃者はデータベースを操作できる悪意のある SQL コマンドを注入でき、アプリケーションのデータ整合性とセキュリティを損なう可能性があります。 再現手順: 1. http://localhost/Bookea-tu-Mesa/ReservationTable.php にアクセスします。 2. 検索フィールドに、次の SQL...

pmanager

Pmanager Demo Description Store and retrieve your passwords from a secure offline database. Check if your passwords has leaked previously to prevent targeted password reuse attacks. Why develop another password manager ? This project was initially born from my desire to learn Rust. I was tired of...

CVE-2026-89640

A flaw was found in the Linux kernel's Common Internet File System CIFS implementation. When performing a file range remapping operation with a zero length, an integer underflow can occur if the offset exceeds the file size. This can lead to corruption of the byte count in file system control...

CVE-2026-89701

A flaw was found in the Linux kernel's Network File System Daemon nfsd. The TIMEDELEGACCESS and TIMEDELEGMODIFY decode paths do not properly validate the nanosecond nseconds value in timestamps. This allows a remote attacker to provide a malformed timestamp, which can then be written to disk,...

CVE-2026-89697

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When setting file attributes using nfsdprocsetattr, a specific code path BOTHTIMESET branch prematurely verifies file handles. This bypasses a critical write verification step fhwantwrite, allowing file attribute changes to...

CVE-2026-89480

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

CVE-2026-89639

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifsinvalidatecache in cifsdotruncate for OTRUNC cifsdotruncate is invoked from cifsopen without irwsem, so it cannot use cifsresizefilelocked to perform a proper fscache cookie resize. Instead, add cifsinvalidatecache...

CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480

CVE-2026-89480 affects the nvme-tcp driver in the Linux kernel . The root cause is that nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, without comparing the total bytes received against the length the command requested. No receive-side counter exists in st...

lazywarden

Secure, Automated, and Multi-Cloud Bitwarden Backup and Import System Lazywarden is a Python automation tool designed to Backup and Restore data from your vault, including Bitwarden attachments. It allows you to upload backups to multiple cloud storage services and receive notifications across...

PT-2026-90196

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme tcp recv data completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for:...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

CVE-2026-88027

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

EUVD-2026-75641

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

EUVD-2026-75451

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...