CVE-2023-3047

Telegram : @ghostmans3c or @Chrome2024 Donate BTC : 17L22i227Keet23QCNaeCyrQ6xfiTQpQJ5 PoC How To Exploit CVE-2023-3047 Description Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell:...

EUVD-2025-211331

: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows : OS Command Injection. This issue...

CVE-2025-43874

A vulnerability exists in several Johnson Controls products, including iSTAR Ultra , iSTAR Ultra SE , iSTAR Ultra G2 , iSTAR Ultra G2 SE , and iSTAR Edge G2 , due to Improper Neutralization of Special Elements used in an OS Command . This flaw allows for OS Command Injection . The issue specifica...

CVE-2026-9821

IBM Cyber Fraud versions 1.0.0 through 1.1.0 are vulnerable to a log injection flaw. The root cause is the improper neutralization of special elements when writing to log files, which could allow an unauthorized user to inject data into log messages . Exploitation details and specific remediation...

CVE-2021-22204

CVE-2021-22204 Description Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Script Script Link Script usage: System cmd: bash CVE-2021-2204.sh "system'id'" happy.jpg Reverse shell bash...

CVE-2026-124410 WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpLingua Translation Service Translate and boost SEO Automatic AI translation wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO Automatic AI translation wpLingua: from...

EUVD-2026-125419

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10...

CVE-2026-125809

The myCred WordPress plugin (versions

CVE-2026-125800 WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5...

CVE-2026-125833

The YITH WooCommerce Ajax Product Filter plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the yith-woocommerce-ajax-navigation component. This issue is caused by Improper Neutralization of Input During Web Page Generation (CWE-79). The vulnerability affec...

CVE-disclosures

CVE-2026-3171 & CVE-2026-3170 – Archana M Official vulnerability disclosures by Archana M. 🔹 CVE-2026-3171 Product: SourceCodester / Patrick Mvuma Patients Waiting Area Queue Management System 1.0 Vulnerability Type: Cross-Site Scripting CWE-79 Affected File: /queue.php Attack Vector: Remote User...

CVE-2026-75650

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75650 Write-up: https://abraxaslabs.tech/research/CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 - Adobe I am @abraxasnull. Loopback lab. The client is CVE-2026-75650-Abraxas-Labs.py...

PT-2026-146876

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8...

PT-2026-147203

IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

ghe-push-option-rce-scanner

CVE-2026-3854 — GitHub Enterprise Server RCE via Push Option Injection Overview Improper neutralization of push option values in GHE. Attacker with push access achieves RCE on the instance. Field| Value ---|--- CVE| CVE-2026-3854 Severity| CRITICAL Product| GitHub Enterprise Server CISA KEV|...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124195

An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 are vulnerable to an improper neutralization of input during web page generation in the Audio Player component. This vulnerability allows remote authenticated users to read or write specific files . Remediation is ...

EUVD-2026-124193

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...