pwnflow

Pwnflow 🎯 Visualize Your Security Testing & Analysis Journey Pwnflow is a mind-mapping platform designed specifically for cybersecurity professionals. it helps you visualize, track, and share your security testing methodologies while maintaining complete control over your sensitive data. 🚀 Key...

koppeling-p

koppeling-p Adaptive DLL hijacking / dynamic export forwarding - EAT preserve Overview This project is a limited, Python-only extension to the amazing project by Nick Landers @monoxgas, available here. Differences The only difference to the original project is that koppeling-p p stands for...

DotNetHookerToolkit

InjectorCli + ManagedHookHostProj This repository contains two projects that are designed to be used together: InjectorCli: A .NET Framework 4.8 console injector built on frida-clr Frida.dll ManagedHookHostProj: A .NET Framework 4.8 helper DLL with native exports via 3F .NET DllExport used to...

UBUNTU-CVE-2026-93581

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

CVE-2026-93581

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

EUVD-2026-97270

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

CVE-2026-93581

The OTRS help desk software (versions 7.0.X , 8.0.X , 2023.X , 2024.X , 2025.X , and 2026.X before 2026.7.X ) is vulnerable to CWE-1236 due to insufficient neutralization of formula elements in CSV exports . An attacker can inject values starting with characters like =, +, -, or @ through user in...

CVE-2026-107914

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export...

CVE-2026-107914

Backdrop CMS versions 1.34 (before 1.34.5) and 1.35 (before 1.35.1) fail to sufficiently protect configuration exports when delivering a compressed archive. This vulnerability, categorized under CWE-497 , allows for the exposure of sensitive system information. The risk is partially mitigated bec...

CVE-2026-107914

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export...

EUVD-2026-95489

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export...

CVE-2026-107914

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export...

CVE-2026-107914: Incomplete Cleanup

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export...

PT-2026-108731

Name of the Vulnerable Software and Affected Versions Backdrop CMS versions 1.34 through 1.34.4 Backdrop CMS versions 1.35 through 1.35.0 Description Insufficient protection of configuration exports occurs when delivering a compressed archive. This issue is linked to the config.admin.inc file...

Exploit for CVE-2026-105844

CVE-2026-105844 — Payload CMS import-export prototype pollutio...

AlmaLinux 9.6 [TuxCare] Security Update: libnfsidmap / libnfsidmap-devel / nfs-stats-utils / nfs-utils / etc (ALMALINUX9.6:CLSA-2026:1773224214)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773224214 advisory. - A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate...

CVE-2026-100564

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

PT-2026-99201

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description The software fails to neutralize spreadsheet formula characters in participant display names during attendance CSV exports. This allows attackers to inject formula-like cells that execute with th...

DRUPAL-CONTRIB-2026-168

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...