Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

haaukins

Haaukins Haaukins is a highly accessible and automated virtualization platform for security education, it has three main components Docker, Virtualbox and Golang, the communication and orchestration between the components managed using Go programming language. The main reason of having Go...

richkit

Richkit Richkit is a python3 package that provides tools taking a domain name as input, and returns addtional information on that domain. It can be an analysis of the domain itself, looked up from data-bases, retrieved from other services, or some combination thereof. The purpose of richkit is to...

RCE-Simplephpblog-biggiedroid

CVE-2025-15495 - Arbitrary File Upload Leading to Remote Code Execution RCE Product BiggiDroid – Simple PHP Blog CMS Product page: https://biggidroid.com/product/simple-php-blog/ Vulnerability Type Arbitrary File Upload Unrestricted File Upload Remote Code Execution RCE Severity Critical CVSS...

CVE-2022-3992

CVE-2022-3992 Cross-Site Scripting in WonderCMS Description: A cross-site scripting XSS vulnerability in Sanitization Management System v1.0 allows potential attackers to upload arbitrary files via a crafted name into the system logo Fields of the System Info Fields. The cookie has no HttpOnly Fl...

CVE-2026-116391

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9...

CVE-2026-116391 WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9...

EUVD-2026-112074

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9...

CVE-2026-116391

The GS Logo Slider plugin for WordPress (versions n/a through 3.8.9 ) is vulnerable to PHP Object Injection via the deserialization of untrusted data . This flaw allows an attacker to inject objects, potentially leading to high impacts on confidentiality, integrity, and availability. No specific ...

PT-2026-128242

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9...

Logo Netsis NetOpenX REST 2.0.6.9 — Unauthenticated SQL Injection to xp_cmdshell — Detect

Fingerprint / reachability check for Logo Netsis NetOpenX REST 2.0.6.9 — Unauthenticated SQL Injection to xpcmdshell SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Logo Netsis NetOpenX REST 2.0.6.9 — Unauthenticated SQL Injection to xpcmdshell SYSTEM RCE""" from kittysploit...

WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GS Logo Slider versions = 3.8.9...

CVE-2026-113595

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

EUVD-2026-105161

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

PT-2026-118455

🚨 CVE-2026-113595 Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE SETTINGS permission. Attackers can remove the current logo and replace it with an upload...

Sharkord authorization issue vulnerability

Versions of Sharkord prior to 0.0.26 have a vulnerability related to authorization. This vulnerability stems from the lack of authorization verification in the others.changeLogo tRPC mutation. As a result, any authenticated member can modify the server’s logo without having the MANAGESETTINGS...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix refcount issue when LOGO is received during TMF A hung task trace was observed during LOGO processing. 974.309060 0000:00:00.0: qedfehdevicereset:868: 1:0:2:0: LUN RESET issued… 974.309065 0000:00:00.0:...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the favicon lookup in the OEmbed service, where the metascraper-logo-favicon dependency's default resolver uses reachable-url, which bundles got v11 and bypasses the...

CVE-2026-105060

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4...