CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-18574

cve-id Пожертвование Помогите поддерживать этот проект Если вы находите этот проект полезным, пожалуйста, рассмотрите возможность поддержки его дальнейшего сопровождения через PayPal или ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Десять процентов от...

CVE-2026-93880

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 13.2.0 . The root cause is insufficient input sanitization and output escaping involving the '{{GET:}}' Dynamic Placeholder . Specifica...

CVE-2026-93880 Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'GET:' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

EUVD-2026-91240

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'GET:' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-93880 Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'GET:' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

Invoke-DCSync

Invoke-DCSync Invoke-DCSync Ссылка: https://adsecurity.org/?p=1729 Ссылка: https://silentbreaksecurity.com/invoke-dcsync-because-we-all-wanted-it/ Цель: получить хэши паролей всех учетных записей пользователей на контроллере домена с помощью функции DCSync от mimikatz. Предупреждение: Делайте это...

Http-Asynchronous-Reverse-Shell

Shell inversée asynchrone HTTP/S ✨ Introduction À une époque où les systèmes de détection avancés tels que IDS, IPS, EDR, AV et pare-feux dominent les réseaux d'entreprise, les contourner lors d'évaluations de sécurité offensive est un défi. La plupart des shells inversés utilisent des tunnels TC...

CVE-2026-58415

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

EUVD-2026-91118

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...

Drupal-cve-2019-6340

Recherche CVE 2019-6340 Le site avec le module Drupal 8 core RESTful API Services activé permet à l'utilisateur d'envoyer des requêtes GET, PATCH ou POST au serveur. Une requête GET suffit pour déclencher la vulnérabilité d'exécution de code même si la méthode PATCH est désactivée Le site a tout...

CVE-2026-82044: Server-Side Request Forgery (SSRF)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf method exposed via GET /api/generate-pdf-report. Attacke...

PT-2026-104080

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-104139

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'GET:' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

Linux Distros Unpatched Vulnerability : CVE-2026-58415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote...

CVE-2020-27368

CVE-2020-27368 TOTOLINK-A702R-V1.0.0-B20161227.1023 Уязвимость индексации каталогов Описание Индексация каталогов на портале входа TOTOLINK-A702R-V1.0.0-B20161227.1023 позволяет злоумышленнику получить доступ к каталогам /icons/ через GET-параметр. Дополнительная информация Устранение: отключение...

CVE-2023-35793-CSRF-On-Web-SSH

CVE-2023-35793-CSRF-On-Web-SSH Le dépôt contient la description de la CVE-2023-35793 découverte par l'équipe Dodge Industrial pour la plateforme Dodge OPTIFY. ID CVE: CVE-2023-35793 Vendeur : Cassia Networks Produit : Access Controller Version : Cassia-AC-2.1.1.2303271039 Vulnérabilité :...

tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-51892

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...

CVE-2026-19975

cve-id Пожертвование Помогите поддерживать этот проект Если вы находите этот проект полезным, пожалуйста, рассмотрите возможность поддержки его дальнейшего сопровождения через PayPal или ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Десять процентов от...