oracleShell

oracleShell Oracle Database Command Execution Test Environment - DBA Privileges: SELECT FROM v$version Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production PL/SQL Release 11.2.0.1.0 - Production "CORE 11.2.0.1.0 Production" TNS for 32-bit Windows: Version 11.2.0.1.0 - Production...

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Summary ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore scri...

CVE-2025-30208

CVE-2025-30208 Detection Tool Vulnerability Analysis Vite Arbitrary File Read Vulnerability Analysis and Reproduction CVE-2025-30208 Introduction This tool is used to detect whether a target system is vulnerable to CVE-2025-30208. This vulnerability allows an attacker to read sensitive files such...

CVE-2019-20085

📂 CVE-2019-20085 – TVT NVMS-1000 Directory Traversal Exploit By Z3R0 Author: Z3R0 CVE: CVE-2019-20085 Target: TVT NVMS-1000 all known versions prior to patch Vuln Type: Unauthenticated Directory Traversal Date: Insert Your Release Date 🔍 Vulnerability Summary TVT's NVMS-1000 software contains a...

DEBIAN-CVE-2026-115572

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...

CVE-2026-115572

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...

EUVD-2026-109128

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...

CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File Read 🔥 Vulnerability Summary The Eventin plugin = 4.0.26 for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxyimage function. Attackers exploit insufficient input validation by manipulating the url...

CVE-2026-55888

A flaw was found in xdg-desktop-portal. An attacker operating a sandboxed application can bypass isolation boundaries to gain unauthorized access to host files. This issue occurs because the FileChooser interface fails to properly validate filenames before passing them to backend services...

EUVD-2026-109119

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

CVE-2026-115569

The codebase intelligence tool Fallow is vulnerable to a path traversal and link following issue in versions 2.68.0 through 3.34.0 . Specifically, attacker-controlled Jest projects paths can force the tool to read files outside the project root using absolute paths, parent segments, dot-prefixed ...

CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior...

EUVD-2026-98694

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks...

CVE-2026-115378

A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating between symbolic links and regular files, the attacker can...

server

Ulterius: Easy Remote Management Interested in sublicensing? Want to use our code in your stack or rebrand it for internal use? Reach out to us at [email protected] Ulterius is a tool that allows unfettered access to a Windows system via a remote web interface. This program allows you to sta...

SUSE CVE-2026-114583

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

phptopwn

PHP2Shell Threat-Intelligence Honeypot A safe, high-interacti...

CVE-2026-106070

A flaw in the Node.js "zlib.ZipFile" API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When "zipEntry.modified" is read on an archive whose local header does not match its central directory, either directly or while...

CLSA-2026-1792769794 flatpak: Fix of CVE-2026-97023

CVE-2026-97023: fix arbitrary file deletion during deploy, where a malicious ostree commit with "export" as a symlink made the path-based export/bin cleanup delete files at the symlink target...