Pluck-CMS-Stored-XSS---Installation

Pluck CMS 4.7.18 XSS Armazenado Autor: Sergio Descrição: Múltiplas vulnerabilidades de Cross-Site Scripting XSS na instalação do PluckCMS v.4.7.18 permitem que um atacante local execute código arbitrário por meio de um payload malicioso injetado nos parâmetros cont1 e cont2 no processo de...

CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation

Cmsmadesimple CMS Reflected XSS v2.2.18 Autore: Sergio Descrizione: Multiple vulnerabilità Cross-Site Scripting XSS nell'installazione di cmsmadesimple v.2.2.18 permettono a un attaccante locale di eseguire script web arbitrari tramite un payload manipolato iniettato nel Nome del Database, Utente...

CVE-2026-65081

NVIDIA NemoClaw for Linux is affected by a vulnerability in its installation process that allows an attacker to cause execution of untrusted code. A successful exploit may lead to code execution , privilege escalation , data tampering , information disclosure , and denial of service . The CNA-ass...

EUVD-2026-66099

NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of servi...

CVE-2021-44909

CVE-2021-44909 Título do Exploit: orangescrum 1.8.0 - Execução Remota de Comandos RCE não autenticado Data: 03/12/2021 Homepage do Fornecedor: https://www.orangescrum.org/ Link do Software: https://github.com/Orangescrum/orangescrum Versão: 1.8.0 Testado em: Windows 10 x64 usando XAMPP 7.4.23,...

-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options

Evolution CMS XSS riflesso v3.2.3 Autore: Sergio Descrizione: Molteplici vulnerabilità di Cross-site scripting XSS riflesso nel processo di installazione di evolution v.3.2.3, nelle opzioni Admin, consentono a un attaccante locale di eseguire script web arbitrari tramite un payload appositamente...

CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-

Evolution CMS XSS Riflesso v3.2.3 Autore: Sergio Descrizione: Una vulnerabilità di cross-site scripting XSS riflesso nel processo di connessione dell'installazione di Evolution v.3.2.3 consente a un attaccante locale di eseguire script web arbitrari tramite un payload appositamente creato inietta...

CVE-2023-43876-October-CMS-Reflected-XSS---Installation

October CMS Reflected XSS v3.4.16 Autore: Sergio Descrizione: La vulnerabilità di Cross-Site Scripting XSS nell'installazione di October v.3.4.16 consente a un attaccante locale di eseguire script web arbitrari tramite un payload appositamente costruito iniettato nel campo dbhost. Vettori di...

Astra Linux – Vulnerability in freeipa

A flaw was identified in the FreeIPA API audit; it sends the entire FreeIPA command line to journalctl. As a result, during the FreeIPA installation process, administrative user credentials—including the administrator’s password—are inadvertently leaked into the journal database. In the worst-cas...

[SECURITY] Fedora 44 Update: openqa-5^20260604git6376095-3.fc44

openQA is a testing framework that allows you to test GUI applications on one hand and bootloader and kernel on the other. In both cases, it is difficult to script tests and verify the output. Output can be a popup window or it can be an error in early boot even before init is executed. openQA is...

PT-2026-50655

It was discovered that Dolibarr incorrectly handled user-supplied database name values during installation. A remote attacker could possibly use this issue to execute arbitrary code...

Malicious code in mozautomation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26d0e7dfb965969f23786d4bde7d70e597b83df522434aea471171d48442cd12 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Canon My Image Garden 安全漏洞

Canon My Image Garden is a photo management and printing software developed by the Japanese company Canon. Versions of Canon My Image Garden 3.6.8 and earlier contained security vulnerabilities. These vulnerabilities were due to improper handling of symbolic links in the installation process, whi...

CVE-2026-7365

IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication...

Synology Assistant 访问控制错误漏洞

Synology Assistant is a network storage device discovery and management tool provided by the Chinese company Synology. Versions of Synology Assistant prior to 7.0.6-50085 contained a access control vulnerability caused by a source verification error. This vulnerability could allow local users to...

EUVD-2025-209932

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication...

CVE-2025-36221 Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication...

CODESYS Development System 安全漏洞

CODESYS Development System is a set of programming tools developed by the German company CODESYS, used in the fields of industrial controllers and automation technology. There is a security vulnerability in the CODESYS Development System. This vulnerability stems from the incorrect default...

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

EUVD-2026-29382

ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if a...