PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

Vulnerability Details A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints like /?jsonld= and /?pasteid. Root Cause Request::getRequestUri sanitizes $SERVER'REQUESTURI' with FILTERSANITIZEURL: php public function getRequestUri $uri =...

CVE-2026-55891

PrivateBin , a zero-knowledge PHP pastebin, is vulnerable to reflected JSON injection in its JSON-LD response paths (/?jsonld= and /?pasteid) in versions prior to 2.0.5 . The root cause is that FILTER_SANITIZE_URL does not strip quotation marks from $_SERVER['REQUEST_URI'], and the unsanitized va...

CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

opendcim-exploit

openDCIM - SQLi para RCE via Envenenamento de Configuração Cadeia de execução remota de código que visa o formulário de configuração LDAP do install.php do openDCIM. Construída sobre o framework VulnCheck go-exploit. Cadeia de Vulnerabilidades...

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-77586

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can...

CVE-2026-77939

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-76797

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-77184

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

CVE-2026-70331

Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network...

Exploits

Exploits CVEs originais, PoCs de exploits e advisories de segurança por @kmkz · boffsec-services.com · @kmkzsecurity 2026 Arquivo| Alvo| Tipo| CVSSv3 ---|---|---|--- CVE-2026-22191-SicuroWeb-ATI-chain.txt| SicuroWeb / Beghelli Sicuro24| Advisory cadeia de 3 CVEs| 9.3 CVE-2026-22191-POC.py|...

CVE-2026-55634

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

CVE-2026-55559

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...

CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-54766

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

litellm-command-injection-security-assessment

CVE-2026-42271 - Iniezione di Comandi MCP nel Gateway AI LiteLLM RCE Report di Cybersecurity in Stile Consulenziale Report professionale di valutazione della vulnerabilità per il rischio di iniezione di comandi in LiteLLM, comprensivo di sintesi esecutiva, impatto tecnico, rimedio e strategia di...

apache-camel-docling-security-assessment

CVE-2026-40047 - Iniezione di Argomenti CLI in Apache Camel Docling Report di Cybersecurity in Stile Consulenziale Report professionale di valutazione delle vulnerabilità per il rischio di convalida degli argomenti in Apache Camel Docling, comprensivo di impatto tecnico, rimedio e strategia di...

CVE-2026-PoCs

CVE-2026-PoCs Una raccolta curata dalla community e verificata di exploit Proof-of-Concept per le CVE divulgate nel 2026. Perché questo repo La maggior parte delle raccolte di PoC per CVE sono sparse tra thread di Twitter, gist e link di blog morti. Questo repo mira a essere l'indice unico, ben...

write-ups

write-ups RCE in Github Desktop v2.9.4 RCE tramite gh run download GitHub CLI Claude Code: esecuzione di codice non sandboxed da prompt injection tramite confusione del worktree .git — CVE-2026-55607...

SAMLRaider

SAML Raider - Estensione Burp per SAML2 Descrizione SAML Raider è un'estensione di Burp Suite per testare infrastrutture SAML. Contiene due funzionalità principali: manipolare messaggi SAML e gestire certificati X.509. Questo software è stato originariamente creato da Roland Bischofberger e Emanu...