ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

Academy LMS 6.0 - Cross-Site Scripting

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. id: CVE-2023-38964 info: name: Academy LMS 6.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Creative Item Academy LMS 6.0 was discovered to...

Mythic-Macro-Generator

Mythic-Macro-Generator Python3-Skript zum Generieren von MS Office-Makros zum Starten von Mythic JXA-Payloads. Dieses Skript generiert ein Office-Makro, das osascript verwendet, um den Mythic JXA .js-Payload herunterzuladen und auszuführen. Schritte: 1. Richten Sie den Mythic C2-Server ein und...

CVE-2023-2591

CVE-2023-2591: Stored HTML Injection in Item Label in Teampass 3.0.6 - M Nadeem Qazi Recentemente ho identificato una vulnerabilità di sicurezza in nilsteampassnet/teampass, un popolare strumento di gestione delle password. Questa vulnerabilità, identificata come CVE-2023-2591, è un'iniezione HTM...

CVE-2026-25596

CVE-2026-25596 — XSS persistente tramite il campo Nome Unità di Prodotto in InvoicePlane 1.7.0 Vulnerabilità: Cross-Site Scripting XSS persistente tramite il campo Nome Unità di Prodotto Prodotto: InvoicePlane Versione interessata: 1.7.0 e probabilmente versioni precedenti Gravità: Media Punteggi...

libfwsi

libfwsi विंडोज शेल आइटम प्रारूप तक पहुंचने के लिए एक लाइब्रेरी है। परियोजना जानकारी: स्थिति: प्रायोगिक लाइसेंस: LGPL-3.0-or-later अधिक जानकारी के लिए देखें: परियोजना दस्तावेज़ीकरण: https://github.com/libyal/libfwsi/wiki/Home स्रोत से निर्माण कैसे करें: https://github.com/libyal/libfwsi/wiki/Build...

CVE-2025-62950-PoC

Descrizione Questa proof of concept PoC descrive una vulnerabilità di Cross-Site Request Forgery CSRF trovata nel plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. Il problema consente a un attaccante di ingannare un utente autenticato affinché esegua una richiesta...

Linux Distros Unpatched Vulnerability : CVE-2026-80536

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098844)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098844 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl...

CVE-2025-47176

CVE-2025-47176 PoC Browser Bridge Beschreibung Dieser Proof-of-Concept PoC demonstriert die Simulation der Sicherheitslücke CVE-2025-47176. Er injiziert ein manipuliertes E-Mail-Element in Outlook, das einen bösartigen Synchronisierungspfad enthält, der beim Scannen eine Aktion auslöst. WICHTIG:...

CVE-2026-55624

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...

EUVD-2026-65513

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...

CVE-2026-55624 MintyItanium Lost-Auction takes items like barrier blocks out from search GUI

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...

CVE-2026-55624

MintyItanium Lost-Auction is an auction plugin for Minecraft servers. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8 , players could take items such as barrier blocks or duplicate items from the search GUI, representing an integrity issue with a CVSS 4.0 base score of 5.3 (Medium) . The...

CVE-2023-3009

CVE-2023-3009 आइटम नाम पर स्टोर्ड XSS - TeamPass 3.0.9 में CVE-2023-2516 को बायपास करना - M Nadeem Qazi द्वारा विवरण यह रिपॉजिटरी nilsteampassnet/teampass एप्लिकेशन में खोजी गई स्टोर्ड XSS भेद्यता को संबोधित करती है, जिसे CVE-2023-2516 पहचानकर्ता सौंपा गया था। इस भेद्यता का फायदा उठाने के लिए, एक...

CVE-2025-56771

الوصف أثناء تحليل موقع ecodotempo.com.br، تم اكتشاف ثغرة تخزين XSS Cross-Site Scripting. تسمح هذه الثغرة للمهاجم بحقن نصوص برمجية ضارة في الحقول التي يتم عرضها لاحقًا لمستخدمين آخرين دون تنقية مناسبة، وتحديدًا على الصفحة الرئيسية للمنطقة غير المصادق عليها غير المتصلة. نقطة النهاية المتأثرة...

duckdb

Jepsen DuckDB Test Jepsen-Tests für die DuckDB-Datenbank. Läuft lokal, anstatt auf einem entfernten Cluster. Der Test startet eine Sammlung lokaler Prozesse, die eine DuckDB-Datei lokal öffnen, und interagiert mit ihnen über STDIN/STDOUT. Dies ist ein früher Prototyp. Er schaltet sich ein, führt...

Astra Linux – Vulnerability in Mariadb 10.3

It was discovered that MariaDB versions from 10.2 to 10.6.1 contain a segmentation fault due to the Itemsubselect::initexprcachetracker component...

Astra Linux – Vulnerability in poppler-22

A vulnerability in Outline.cc for Poppler prior to version 23.06.0 allows a remote attacker to cause a Denial of Service DoS attack through a crafted PDF file using the OutlineItem::open method...

EUVD-2026-64412

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...