Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability...

Sangoma Switchvox SQL Injection Vulnerability

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution...

PT-2026-84855

Name of the Vulnerable Software and Affected Versions Hermes version 0.21.0 Description An issue exists where coding agents execute git status or git diff for context gathering before trust prompts are presented to the user. If a repository is delivered as files such as via zip, sync, or USB rath...

PT-2026-84684

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

CVE-2025-46418

Westermo WeOS 5 (version 5.24 and later), an operating system deployed in industrial settings, is vulnerable to OS command injection through unsafe handling of media definitions . An attacker with administrative privileges can execute commands beyond their typical access rights, potentially compr...

Linux Distros Unpatched Vulnerability : CVE-2026-84233

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes...

CVE-2025-46418

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...

Kestra OSS OS Command Injection Vulnerability

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...

PT-2026-84573

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

EUVD-2025-210821

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

CVE-2025-7606

CVE-2025-7606 code-projects AVL Rooms Project V1.0/city.php inyección SQL NOMBRE DEL PRODUCTOS AFECTADOS AVL Rooms Página de inicio del proveedor https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ remitente dazhi Archivo vulnerable /city.php VERSIONES V1.0 Enlace d...

CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Project V1.0/profile.php Inyección SQL NOMBRE DEL PRODUCTOS AFECTADOS AVL Rooms Página web del vendedor https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ Remitente dazhi Archivo vulnerable /profile.php VERSIÓNES V1.0 Enlace de...

Published-CVE

Published-CVE Este repositorio contiene descripciones y exploits para dos vulnerabilidades de seguridad: 1. CVE-2023-33580: Cross-Site Scripting Almacenado XSS en el Student Study Center Management System V1.0, que permite a atacantes ejecutar código JavaScript arbitrario. 2. CVE-2023-33584:...

CVE-2020-3187

CVE-2020-3187 curl -H "Cookie: token=. ./+CSOU+/cscologo.gif" https://target.com/+CSCOE+/sessionpassword.html logo.gif se eliminará...

CVE-2024-43917

CVE-2024-43917 Una prueba de concepto desarrollada para explotar CVE-2024-43917. Basada en el artículo de PatchStack. Uso root@kitploit: usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute...

CVE-2019-6690-python-gnupg-vulnerability

CVE-2019-6690: Validación de entrada incorrecta en python-gnupg 0.4.3 Descubrimos una forma de inyectar datos a través de la propiedad passphrase de los métodos gnupg.GPG.encrypt y gnupg.GPG.decrypt cuando se utiliza cifrado simétrico. La passphrase suministrada no se valida para saltos de línea,...

CVE-2020-28243

CVE-2020-28243 Una vulnerabilidad de inyección de comandos en SaltStack's Salt permite la escalada de privilegios a través de nombres de proceso especialmente diseñados en un minion cuando el master llama a restartcheck. Para un análisis completo, consulte esta publicación de blog Versiones...

CVE-2023-28354

CVE-2023-28354 漏洞描述 Opsview Monitor Agent 6.8 中存在一个漏洞，允许未经认证的远程攻击者执行任意命令。未经认证的攻击者可以通过在调用默认的 Opsview Agent Monitor 脚本时提供命令行转义序列来利用此漏洞（针对 Windows 系统），从而执行任意系统命令。 描述 Windows 上的 Opsview Agent 服务默认以 Local System 身份运行。此默认配置还包含多个 NRPE...

CVE-2021-31856

漏洞报告 CVE-2021-31856: Meshery中的SQL注入 项目| 详情| 备注 ---|---|--- 项目| https://github.com/layer5io/meshery| 公告日期| 2021-04-28| CVE-ID| CVE-2021-31856| https://vulners.com/cve/CVE-2021-31856 EDB-ID| | 受影响版本| v0.5.2| \ 修复版本| v0.5.3| https://github.com/layer5io/meshery/pull/2745 CVSS| 7.5...