sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input that contains numerous comment-only statements. This could cause the groupcomments function to repeatedly rescan these statements, leading to...

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2025-25347

CVE-2025-25347 概要 このツールは、タスク自動化管理のためのオープンソースプラットフォームであるQingLong PanelのCVE-2025-25347 脆弱性をテストするために使用されます。 この脆弱性はRemote Code Execution RCEを可能にします。パネルが特定のエンドポイントで適切な入力検証とアクセス制御を実装していないためです。その結果、有効な認証情報を持たない攻撃者が任意のシステムコマンドを実行でき、QingLongサーバーまたはコンテナの完全な乗っ取りにつながる可能性があります。 開発者: Ohang 謝辞: My Mentor CAC 目的...

CVE-2026-84714

A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...

CVE-2025-50565

CVE-2025-50565 説明 Doubo ERP 1.0 には、ユーザー入力のフィルタリングが不足していることによるSQLインジェクションの脆弱性があり、攻撃者によりリモートから悪用される可能性があります。 脆弱性タイプ SQLインジェクション 攻撃タイプ リモート 影響情報開示 true ベンダー確認済み true 発見者 https://www.jump.net.cn 参考文献 https://www.jump.net.cn https://v12.icu 影響を受ける製品コードベース Doubo ERP 1.0...

CVE-2026-71300

A flaw was found in Apache Camel Atmosphere Websocket. This improper input validation vulnerability allows a remote attacker to inject specific Exchange headers, such as websocket.connectionKey.list, which are not properly filtered. By manipulating these headers, an attacker can take control of t...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 バリデーションルールインジェクション CVE-2023-32692 は、CodeIgniter 4 PHP フレームワークにおけるコードインジェクションの脆弱性で、バージョン 4.0.0 から 4.3.4 に影響します。これは 4.3.5 （2023年6月リリース）で修正されました。このリポジトリは、この脆弱性を試してみたい人向けのデモ環境です。 脆弱性の詳細は MOGWAI LABSブログ で確認できます。 PoC 環境 このリポジトリには、この脆弱性を実証する最小限のCodeIgniter...

Security Bulletin: This Power System update is being released to address CVE-2026-17503

Summary Power Systems Firmware is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention —...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

vulnerabilities in Adobe Experience Manager Forms JEE

Adobe has identified 6 vulnerabilities in Adobe Experience Manager AEM Forms for Java Enterprise Edition JEE, including AEM 6.5 Forms and AEM 6.5 LTS Forms. These vulnerabilities concern various security issues, such as improper authorization, inadequate input validation, Server-Side Request...

CVE-2026-80444

URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...

EUVD-2026-85259

URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...

CVE-2026-80444 Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS

URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...

CVE-2026-80444

Abis Technology Ltd. Co. AVESİS is vulnerable to an open redirect vulnerability caused by Input Data Manipulation . This flaw allows an attacker to redirect users to an untrusted site. The issue specifically affects versions from 202608201331 before 202608240351 . Exploitation details are not pro...

CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

reproducing-CVE-2025-1489

CVE-2025-1489 の再現 このリポジトリは、Web関連のCVE CVE-2025-1489 を安全な環境で再現し、フォレンジック/脆弱性分析スキルを実演・練習するためのものです。 特定・再現された脆弱性は、WordPressプラグインWP-Appbox バージョン4.5.4 におけるストアドクロスサイトスクリプティング XSS...

libxml2 security, bug fix, and enhancement update

An update is available for libxml2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...