CVE-2023-33404

CVE-2023-33404 A user who has EditOwnPosts right on BlogEngine.NET CMS version 3.3.8.0 and earlier has the ability to upload a malicious file to a hard-coded location. POST request to /api/upload endpoint with "action=video" parameters, as shown in the screenshot below, triggers a file upload...

EUVD-2026-69428

Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing...

CVE-2026-45221

Konga before 2.1.0 is vulnerable to local privilege escalation via a hardcoded OpenSSL filesystem path that does not exist in default installations. On Windows , the missing directory sits in a location writable by any authenticated local user, allowing an attacker to create it and plant maliciou...

CVE-2025-70342

CVE-2025-70342: Intercettazione delle credenziali tramite Named Pipe in erase-install Riepilogo erase-install antecedente alla v40.4 commit 2c31239 scrive l'output delle credenziali di swiftDialog in un percorso hardcoded /var/tmp/dialog.json. Su Mac Apple Silicon, le credenziali di amministrazio...

CVE-2023-28252-

CVE-2023-28252- Erkennung des Exploits CVE-2023-28252. Überwachung der Dateierstellung in dem Verzeichnis, in dem der Exploit die für die Ausnutzung verwendeten Dateien hinterlässt, auf dem festen Pfad im Ordner "C:\Users\Public", "C:\Users\Public.container", "C:\Users\Public\MyLog.blf" und...

EUVD-2025-208272

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attacker to intercept admin credentials entered during reinstall/erase operations via creating a named pipe...

CVE-2025-70342

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attacker to intercept admin credentials entered during reinstall/erase operations via creating a named pipe...

CVE-2025-70342

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attacker to intercept admin credentials entered during reinstall/erase operations via creating a named pipe...

CVE-2025-70342

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attacker to intercept admin credentials entered during reinstall/erase operations via creating a named pipe...

CVE-2025-70342

erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unauthenticated attacker to intercept admin credentials entered during reinstall/erase operations via creating a named pipe...

Exploit for CVE-2025-70342

CVE-2025-70342: Credential Interception via Named Pipe in eras...

Malicious code in magichat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b999f3f5762dc9bcb0dc2e91ef10116a368aca535d2f07fa2519e8d64bbc0902 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...

EUVD-2024-48259

Malicious code in bioql PyPI...

EUVD-2025-31429

Malicious code in bioql PyPI...

CVE-2025-7647 Insecure Temporary File Handling in run-llama/llama_index

The llama-index-core package, up to version 0.12.44, contains a vulnerability in the getcachedir function where a predictable, hardcoded directory path /tmp/llamaindex is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal...

CVE-2025-7647

CVE-2025-7647 affects llama-index-core up to version 0.12.44, with a vulnerability in get_cache_dir() that uses a predictable, hardcoded directory path (/tmp/llama_index) on Linux. On multi-user Linux systems, this insecure temporary directory can enable local attackers to steal proprietary model...

CVE-2025-7647 Insecure Temporary File Handling in run-llama/llama_index

The llama-index-core package, up to version 0.12.44, contains a vulnerability in the getcachedir function where a predictable, hardcoded directory path /tmp/llamaindex is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal...

VulnCheck KEV: CVE-2024-7344

Howyar UEFI Application "Reloader" 32-bit and 64-bit is vulnerable to execution of unsigned software in a hardcoded path...

CVE-2024-7344

Howyar UEFI Application "Reloader" 32-bit and 64-bit is vulnerable to execution of unsigned software in a hardcoded path...

CVE-2024-7344 Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.

Howyar UEFI Application "Reloader" 32-bit and 64-bit is vulnerable to execution of unsigned software in a hardcoded path...