EUVD-2026-66391

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

EUVD-2026-66401

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device...

EUVD-2026-66393

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device...

EUVD-2026-66392

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

EUVD-2026-66360

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

EUVD-2026-66383

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device...

EUVD-2026-66384

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

EUVD-2026-66364

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device...

CVE-2020-9758

CVE-2020-9758 Beschreibung Ein Problem wurde in chat.php von LiveZilla Live Chat 8.0.1.3 Helpdesk entdeckt. Eine blinde JavaScript-Injektion liegt im Parameter name vor. Das Auslösen kann die Benutzernamen und Passwörter der Helpdesk-Mitarbeiter in der URI abrufen. Dies führt zu einer...

wp2shell-poc

wp2shell PoC Il primo PoC in assoluto della SQL injection basata su timing in pre-autenticazione per la catena di confusione batch-route dell'API REST di WordPress CVE-2026-63030 + CVE-2026-60137 Ottiene l'esecuzione di comandi, senza limitarsi a tentare di forzare la password dell'amministratore...

hopgoblin

hopgoblin hopgoblin é um scanner para instâncias do Adobe Experience Manager AEM. Ele automatiza uma série de verificações que realizamos frequentemente manualmente durante avaliações de segurança. Funcionalidades Detecta endpoints do QueryBuilder expostos: /bin/querybuilder.json...

UniPwn

Analisi dell'iniezione di comandi del servizio BLE del robot Unitree Autore: Bin4ry aka Andreas Makris [email protected] Coautore: h0stile aka Kevin Finisterre Contributore: legion1581 aka Konstantin Severov di theroboverse ha contribuito a correggere il payload per l'iniezione e lo ha...

CVE-2026-82017

IGEL OS 12 (before 12.7.6 ) and 11 (before 11.11.150 ) are affected by a boot registry parameter injection vulnerability. The root cause is an unencrypted and unsigned configuration area that is read by the signed bootloader. An attacker with physical access can write malicious Linux kernel comma...

CVE-2026-41242

CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4 Critical | Code Injection CWE-94 Panoramica protobuf.js npm: protobufjs nelle versioni ≤ 7.5.4 e ≤ 8.0.0 è affetto da una vulnerabilità di esecuzione arbitraria di codice tramite i nomi dei tipi nello schema protobuf. Il modulo...

unknownpwn.github.io

Vulnerabilità ed Exploit dei LED Video Wall Tecnovision. Dalla SQLi al pieno accesso root. Introduzione: Tecnovision è un produttore di LED Video Wall utilizzati negli stadi per esempio, il Twickenham Stadium, nelle sale da concerto, nei centri commerciali, come segnaletica stradale e molto altro...

CVE-2026-3627

IBM Concert versions 1.0.0 through 2.3.1 are vulnerable to SQL injection . A remote attacker with no prior authentication can send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. The vulnerability is rated CVSS 9.1 (CRITICAL) with a network attack v...

CVE-2026-18904

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an authorization bypass (CWE-639) stemming from a namespace collision between user identifiers . The public flow metadata endpoint exposes the owner's user_id, which an unauthenticated attacker can reuse as a client_id to collide with...

Privilege-escalation-ASKEY

Привилегии-эскалация-ASKEY-Router-RTF3505VW-N1 CVE-2022-47040 Уязвимость повышения привилегий на роутерах ASKEY Устройство: ASKEY RTF3505VW-N1 Прошивка: BRSVg000R3505VMN1001s327 не тестировалось на других версиях Версия CLI: ReducedCLIHGUv13 Эксплойт: Устройства ASKEY RTF3505VW-N1 предоставляют...

MAL-011

MAL-011: Неправильная конфигурация Log4J позволяет выполнение вредоносного JavaScript в Red Hat AMQ Компонент Log4J приложения Redhat A-MQ настроен неправильно, что позволяет выполнение произвольных атрибутов “Script” в конфигурации Log4J. Если злоумышленник найдёт способ изменить конфигурацию...

MAL-009

MAL-009: Небезопасное сцепление флагов T и TT в Zip для Linux В Zip для Linux флаг «-TT» может использоваться для выполнения произвольных системных команд. Из-за опасной природы этого флага его всегда следует использовать одновременно с флагом «-T». С помощью атаки со сцеплением флагов...