CVE-2026-25632

CVE-2026-25632 — RCE через JSON-десериализацию в REST API задача на исправление ошибки Основано на реальной уязвимости 2026 года CVSS 10.0, активно эксплуатировалась На основе: CVE-2026-25632 — удалённое выполнение кода RCE через небезопасную JSON-десериализацию на основе type, обнаруженную в RES...

CVE-2024-6624

CVE-2024-6624 JSON API User = 3.9.3 - Неаутентифицированное повышение привилегий Описание Плагин JSON API User для WordPress уязвим к повышению привилегий во всех версиях до 3.9.3 включительно. Это связано с неправильным контролем над пользовательскими мета-полями. Это позволяет...

CVE-2025-65881

CVE-2025-65881 Проект Zoo Management System v1.00 уязвим к межсайтовому скриптингу XSS через /zms/classes/Login.php?f=login из-за: 1. Некорректного Content-type JSON-ответов на /zms/classes/Login.php?f=login 2. Несанитизированного пользовательского ввода в ответах Это позволяет...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| || | | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Профессиональный инструментарий для тестирования безопасности JWT. Анализируйте, взламывайте, подделывайте и эксплуатируйте JSON Web...

CVE-2016-4010

CVE-2016-4010 CVE-2016-4010 Запустите exploit.php, чтобы сгенерировать json payload Запустите exploit.py с сгенерированным payload в triggervulnerabilitypayload...

CVE-2026-30951

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026-30951 Sequelize ORM SQL Injection PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 개요 CVE-2026-30951 은 널리 사용되는 Node.js ORM인 Sequelize v6 의 SQL Injection 취약점입니다. 이 취약점은 JSON/JSONB where 절 처리 과정에 존재합니다...

28458

CVE-2020-28458 Затронутые версии этого пакета уязвимы для загрязнения прототипа Prototype Pollution. datatables v1.10.16-1.10.16 Использование Запустите Python-скрипт и введите необходимые данные: Целевой URL URL прокси необязательно, оставьте пустым, если не используется Тайм-аут в секундах по...

json_cve_2020_10663

Обходной путь для CVE-2020-10663 уязвимость в gem json Gem json содержит уязвимость безопасности CVE-2020-10663. При разборе некоторых JSON-документов gem json может быть принуждён к созданию произвольных объектов в целевой системе. Пользователям настоятельно рекомендуется обновиться до json 2.3....

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

EUVD-2026-90685

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

Resource Allocation

com.github.java-json-tools, jackson-coreutils is vulnerable to resource allocation. The vulnerability is due to improper resource allocation in the TreePointer.tokensFromInput function of the JSON Pointer parser, which allows a remote attacker to exploit the parser and cause excessive resource...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2025-55182-poc-json

CVE-2025-55182-poc-json CVE-2025-55182-poc-json en0f...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2025-11988

1 Извлекаем публичный nonce cryptoajax UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

CVE-2026-92245

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

EUVD-2026-90464

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

CLEANSTART-2026-BR90501 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

AlmaLinux 9.6 [TuxCare] Security Update: iperf3 / iperf3-devel (ALMALINUX9.6:CLSA-2026:1788821988)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788821988 advisory. - A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeri...