CVE-2024-23113

CVE-2024-23113 El script está diseñado para detectar CVE-2024-23113, una vulnerabilidad de cadena de formato en el servicio FGFM de FortiGate protocolo FortiGate a FortiManager que se ejecuta en el puerto TCP 541. La vulnerabilidad se produce porque un atacante puede controlar una cadena de...

CVE-2020-15051

CVE-2020-15051 : Artica Proxy anterior a 4.28.030418 Community Edition permite Cross Site Scripting Almacenado. Descripción del producto: Artica Tech ofrece una solución potente pero fácil de usar, normalmente reservada a grandes empresas y multinacionales. Con un precio inicial de solo 99€ y más...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-11744

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...

CVE-2023-32571

🐞 CVE-2023-32571 - Ejecución remota de código en System.Linq.Dynamic.Core Prueba de concepto para CVE-2023-32571, una vulnerabilidad de ejecución remota de código en System.Linq.Dynamic.Core 1.0.7.10 a 1.2.25. Esta vulnerabilidad permite a los atacantes ejecutar código y comandos arbitrarios cuan...

EUVD-2026-85813

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...

CVE-2026-84151

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

EUVD-2026-85800

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

POC_CVE-2024-10829

POCCVE-2024-36420 Laboratorio de reproducción local y borrador de plantilla de nuclei para CVE-2024-36420 que afecta a Flowise. Resumen CVE-2024-36420 es una lectura arbitraria de archivos en Flowise causada por el uso no saneado del parámetro del cuerpo fileName en: POST...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

UBUNTU-CVE-2026-93826

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidppconnectevent If inputregisterdevice fails, we call inputfreedevice, but keep stale pointer to the old device in hidpp-input, which could potentially lead to UAF. Fix that by resetting it to...

CVE-2025-12758

CVE-2025-12758: Bypass del Selector de Variación Unicode en isLength de Validator.js ID de CVE: CVE-2025-12758 Puntuación CVSS: 8.7 ALTA Severidad: ALTA CWE: CWE-792 Filtrado incompleto de una o más instancias de elementos especiales Publicado: 26 de noviembre de 2025 Divulgado: 19 de octubre de...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input that contains numerous comment-only statements. This could cause the groupcomments function to repeatedly rescan these statements, leading to...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2025-25347

CVE-2025-25347 Resumen Esta herramienta se utiliza para probar la vulnerabilidad CVE-2025-25347 en QingLong Panel, una plataforma de código abierto para la gestión de automatización de tareas. Esta vulnerabilidad permite Remote Code Execution RCE porque el panel no aplica una validación de entrad...