Netgear DGN2200 - Improper Authentication

A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the requested url, it will be recognized as passing the authentication. id: CVE-2024-57046 info: name: Netgear DGN2200...

Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'aid' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

WordPress Plugin MainWP Child - Authentication Bypass

The plugin is vulnerable to an authentication bypass that allows an unauthenticated user to login as an administrator without providing a password. This vulnerability is only exploitable when the plugin has not been connected to a MainWP Dashboard and the "Require unique security ID" option is no...

Tube Video Ads Lite - Reflected XSS

Tube Video Ads Lite WordPress plugin = 1.5.7 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craf...

File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read...

Cleo Harmony < 5.8.0.21 - Arbitary File Read

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution. id: CVE-2024-50623 info: name: Cleo Harmony 5.8.0.21 - Arbitary File Read author: DhiyaneshDK severity: high...

Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure

Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts,...

GL.iNET SSID Key Disclosure

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. id: CVE-2023-31478 info: name: GL.iNET SSID Key Disclosure author: DhiyaneshDK severity: high description: | An issue was discovered on GL.iNet...

WordPress WP01 - Path Traversal

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2. id: CVE-2025-30567 info: name: WordPress WP01 - Path Traversal author: s4e-io severity: high description: | Improper...

Breeze <= 2.4.4 - Arbitrary File Upload

Breeze Cache WordPress plugin = 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetchgravatarfromremote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled. id:...

WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

CVE-2024-30088-

Слабость: CWE-367: Состояние гонки «проверка-по-использованию» TOCTOU Источник CVSS: Microsoft CVSS: 3.1 7.0 / 6.3...

CVE-2024-28995

Эксплойт для CVE-2024-28995 5 июня 2024 года компания SolarWinds опубликовала уведомление об уязвимости CVE-2024-28995 — высокоопасной уязвимости обхода каталогов, затрагивающей их решение для передачи файлов Serv-U. Уязвимость была обнаружена исследователем Хусейном Дахером из Web Immunify...

CVE-2020-1938

CVE-2020-1938 Suricata правила обнаружения CNVD-2020-10487 CVE-2020-1938 alert tcp any any - any 8009 msg:"CNVD-2020-10487 Ghostcat"; content:"javax|2e|servlet|2e|include|2e|requesturi"; content:"javax|2e|servlet|2e|include|2e|pathinfo"; content:"javax|2e|servlet|2e|include|2e|servletpath";...

CVE-2026-8054

1. Обзор уязвимости CVE-2026-8054 — это критическая уязвимость SQL-инъекции без аутентификации Pre-auth SQL Injection в API публикации аудита Publish Audit API ядра dotCMS. Официально уязвимость отслеживается как инцидент безопасности SI-75 и была официально зарегистрирована и раскрыта в конце ма...

CVE-2026-5513

CVE-2026-5513 — Bookly ≤ 27.2 Хранимая XSS через Cookie Обзор Поле| Значение ---|--- CVE ID| CVE-2026-5513 Уязвимость| Хранимая межсайтовая атака XSS Плагин| Bookly — Система онлайн-записи и бронирования Затронутые версии| ≤ 27.2 Исправлено в| 27.3+ CVSS 3.1| 7.2 Высокий —...

CVE-2022-22718

Уязвимость повышения привилегий в диспетчере печати Windows 9 февраля 2022 года: Агентство по кибербезопасности и защите инфраструктуры США CISA добавило уязвимость диспетчера печати Windows в свой список активно эксплуатируемых уязвимостей. Уязвимость была идентифицирована как CVE-2022-22718 с...

CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113 – 연락처 양식의 SMTP 헤더 인젝션 프로그램 코드 Python contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact: sender = request.form'email' message = request.form'message'...

CVE-2026-21006-Zigbee-Light-Link-Factory-Reset-Exploit

CVE-2026-21006 – Zigbee Light Link 공장 초기화 익스플로잇 프로그램 코드 Python Zigbee 시뮬레이션 zigbeefactoryreset.py - Simulated Zigbee coordinator sending factory reset command import time class ZigbeeDevice: def initself: self.networkkey = b'secret' def receivecommandself, cmdid: if cmdid == 0x00: Factory Reset...