CVE-2023-31443

CVE-2023-31443 nordugrid-arc-wn 6.14.0 DoS/LPE. Suggested description NorduGrid nordugrid-arc-wn 6.14.0 has the arc-job-cgroup SUID binary that is vulnerable to a path traversal attack. Combined with a race condition, the attacker can write the ppid to any file as long as the file is writable by...

CVE-2025-67730

CVE-2025-67730 – Stored Cross-Site Scripting XSS Overview CVE ID: CVE-2025-67730 Vulnerability Type: Stored Cross-Site Scripting XSS Severity: Medium–High context-dependent This vulnerability allowed authenticated users to inject malicious HTML and JavaScript into description fields of Job , Cour...

Malicious code in py-wormgpt (PyPI)

Source: kam193 6f7fef8f962798019886211ac43e0e0660feae94e4396fc7969643400b2fa139 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-17883 Malicious code in py-worm (PyPI)

Importing py-worm's agentaix module downloads a mutable Python file from https://raw.githubusercontent.com/anonrider404/pypl/refs/heads/main/readme.txt to a temporary .py file and launches it without a visible console on Windows. Versions 0.1.0 and 2.0.0 do this directly during import; version...

CVE-2015-6668

CVE-2015-6668 Title: CV filename disclosure on Job-Manager WP Plugin...

CVE-2026-4480-PoC

CVE-2026-4480: Samba print-command %J injection PoC Important — Read this first: This repository and exploit.py are provided for educational and research purposes only. Do not use this code against systems, networks, or services for which you do not have explicit, written authorization...

Ray < 2.52.0 - Remote Code Execution

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

GestioIP - Reflected Cross-Site Scripting

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ipdojob request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions. id: CVE-2024-50857 info: name: GestioIP - Reflected Cross-Site Scripting author:...

WordPress Job Portal < 2.0.6 - SQL Injection

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape the city parameter before using it in a SQL statement,leading to a SQL injection vulnerability that is exploitable by unauthenticated users. This vulnerability can be used to extractsensitive data from the database or...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

XXL-JOB v2.2.0 — Stored Cross Site Scripting

Multiple cross-site scripting XSS vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 AppName and 2AddressList parameter in JobGroupController.java file. id: CVE-2020-23814 info: name: XXL-JOB v2.2.0 — Stored Cross Site Scripting author:...

Complete Online Job Search System 1.0 - Cross-Site Scripting

Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch. id: CVE-2022-29316 info: name: Complete Online Job Search System 1.0 - Cross-Site Scripting author: arafatansari severity: high description: | Complete Online Job Search System 1.0...

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/admin/company/index.php?view=edit&id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site...

CVE-2026-106706

XXL-JOB versions through 3.5.0-SNAPSHOT are vulnerable to stored cross-site scripting (XSS) within the GLUE code editor . The vulnerability exists because the JobCodeController.save() method stores the user-supplied glueSource parameter without proper output encoding. Subsequently, the FreeMarker...

CVE-2026-106707

The XXL-JOB framework, version

EUVD-2026-102257

XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...

EUVD-2026-102258

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...

CVE-2026-106707

XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...