CVE-2026-18390

The UYAP Document Editor (Ministry of Justice General Directorate of Information Technology) is vulnerable to an OS command injection flaw in versions before 5.4.20 . The vulnerability stems from the improper neutralization of special elements used in an OS command, potentially allowing an attack...

CVE-2026-108790

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be...

CVE-2026-108790

A security flaw in westboy CicadasCMS (up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab) allows for path traversal via the TemplateController.save function located at /system/cms/template/save within the Backend Template Editor component. This vulnerability can be triggered remotely, and an...

EUVD-2026-97160

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be...

CVE-2026-108790 westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be...

PT-2026-110600

Name of the Vulnerable Software and Affected Versions UYAP Document Editor versions prior to 5.4.21 Description Improper neutralization of special elements used in an OS command leads to an OS command injection flaw in the Ministry of Justice General Directorate of Information Technology UYAP...

CVE-2026-18390: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document...

CVE-2026-12613: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue...

CVE-2026-108790: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be...

CVE-2026-103535: Improper Control of Generation of Code

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The itemname parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This...

PT-2026-110428

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS versions prior to 2431154dac8d0735e04f1fd2a3c3556668fc8dab Description A remote path traversal flaw exists in the Backend Template Editor component. The issue occurs within the TemplateController.save function located in the...

PT-2026-110599

Name of the Vulnerable Software and Affected Versions UYAP Document Editor versions prior to 5.4.21 Description Deserialization of untrusted data in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This occurs when the application...

PT-2026-110616

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.1 Description The translation editor contains path traversal and PHP code injection flaws that can be chained to achieve remote code execution. The item name parameter, used to construct the translation file's write path,...

rehex

Editor Hexadecimal para Ingenieros Inversos Un editor hexadecimal multiplataforma Windows, Linux, macOS, BSD para ingeniería inversa y todo lo demás. Se puede acceder a una copia en línea del manual aquí: solemnwarning.net/rehex/manual/. Características Soporte para archivos grandes 1TB+...

heappy

🙂 Heappy: un editor de heap feliz Heappy es un editor basado en gdb/gef que te ayuda a manejar el heap durante el desarrollo de tus exploits. El proyecto debe considerarse una herramienta didáctica útil para comprender la evolución del heap durante el ciclo de vida del proceso. Se ha creado para...

fhex

Fhex - Un Editor Hex Completamente Funcional Este proyecto nace con el objetivo de desarrollar una herramienta ligera pero útil. La razón es que los editores hex existentes tienen algunas limitaciones diferentes por ejemplo, demasiadas dependencias, falta de características de coloreado hex, etc...

CVE-2026-103897

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-103897 Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-103897

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.7.9 . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter. This allows authenticated attackers with editor-l...

EUVD-2026-96219

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...