PoC-for-CVE-2020-28948-CVE-2020-28949

POC for CVE-2020-28948 & CVE-2020-28949 The files here contain PoC for CVE-2020-28948 & CVE-2020-28949 to achieve remote exploit The server The server folder contains a simple upload server which uses the vulnerable ArchiveTar library, located in server/Archive. The server accepts a Tar archive...

CLEANSTART-2024-SZ97187 GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability

Security vulnerability affects the gimp package. GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability...

CLEANSTART-2024-IP30957 GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability

Security vulnerability affects the gimp package. GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability...

CLEANSTART-2024-GC14102 GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Security vulnerability affects the gimp package. GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability...

CLEANSTART-2024-HD72386 GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Security vulnerability affects the gimp package. GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability...

DEBIAN-CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

CLEANSTART-2024-GW64196 Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP...

Security vulnerability affects the drupal7 package. Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations...

CVE-2026-76012

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

CVE-2026-115346

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

CVE-2026-104739

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

CLEANSTART-2026-LP18799 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

CVE-2025-61728 affects multiple packages. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. See references for individual vulnerability details...

CVE-2026-62121 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

CVE-2026-62121 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

EUVD-2026-114269

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

CVE-2026-62121

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin (versions up to and including 2.0.26 ) is vulnerable to a Local File Inclusion (LFI) vulnerability. The root cause is the Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98), whi...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Siyang Wu in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.26...

CVE-2026-119117 Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...

CVE-2026-119117 Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...

CVE-2026-119117

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...

CVE-2026-119117

The Amazon Kinesis Producer Library for Java (versions prior to 1.0.8 ) is vulnerable to the insertion of sensitive information. When the library's logger is set to DEBUG level, it may write resolved AWS credentials into log files. Additionally, the library passes these credentials as command-lin...