Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs...

Book Store Management System 1.0.0 - Stored Cross-Site Scripting Vulnerability

Exploit Title: Book Store Management System 1.0.0 - Stored Cross-Site Scripting XSS Exploit Author: Rajeshwar Singh Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsmsci.zip Tested on: Windows/XAMPP Payload use...

CVE-2022-28313

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

CVE-2022-43626

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-43639

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 12.0.1.12430. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-1274

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users...

Kiwi TCMS Cross-Site Scripting Vulnerability

Kiwi TCMS is Kiwi TCMS open source a leading open source test management system for manual and automated testing. A cross-site scripting vulnerability exists in Kiwi TCMS versions prior to 12.1. An attacker exploiting this vulnerability can execute JavaScript code...

CVE-2022-1274

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users...

CVE-2022-1274: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users...

CVE-2022-1274

CVE-2022-1274 is referenced in Red Hat advisories RHSA-2023-1043/1044 as a fix for Red Hat Single Sign-On 7.6.2 on RHEL 7/8/9. The vulnerability is linked to Keycloak’s execute-actions-email flow, with the cited issue being a missing email notification template allowlist that can enable an XSS-li...

CVE-2022-1274

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users...

CVE-2022-46387

ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to change the title and then execute it as commands...

OPSWAT Metadefender Core - Privilege Escalation Exploit

Exploit Title: OPSWAT Metadefender Core - Privilege Escalation Exploit Author: Ulascan Yildirim Vendor Homepage: https://www.opswat.com/ Version: Metadefender Core 4.21.1 Tested on: Windows / Linux CVE : CVE-2022-32272 =============================================================================...

CVE-2023-27246

An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess file...

CVE-2022-46387

ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to change the title and then execute it as commands...

PT-2023-14924 · Conemu +1 · Conemu +1

Name of the Vulnerable Software and Affected Versions: ConEmu versions prior to 220807 Cmder versions prior to 1.3.21 Description: The issue allows an attacker to change the title of the terminal, including control characters, which can then be executed as commands. This is related to the handlin...

CVE-2023-28650

An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute the malicious JavaScript JS payload in the target’s security context...

CVE-2023-25909 HGiga Inc. OAKlouds - Arbitrary File Upload

HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service...

Apple macOS Ventura security vulnerabilities

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura, which originates from the handling of maliciously crafted files that could result in the unexpected termination of an application or arbitrary code...

CVE-2023-26802

An issue in the component /networkconfig/nsgmasq.cgi of DCN Digital China Networks DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request...