beyondtrust-cve-2026-1232

🔍 Recherche de Vulnérabilités Une collection sélectionnée de rapports détaillés sur les vulnérabilités couvrant des incidents de sécurité réels dans l'écosystème logiciel. Chaque entrée comprend une analyse technique complète, une preuve de concept, une liste d'IOC et des conseils de remédiation...

CVE-2026-79154

CVE-2026-79154 is a missing authorization flaw in DevTools in Google Chrome prior to 152.0.7977.65 . A remote attacker leveraging social engineering could obtain sensitive information through UI Interaction with DevTools. Chromium rates the severity as Medium . The fix is available in Chrome 152....

CVE-2026-78944

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-79094

CVE-2026-79094 is a race condition in the Workers component of Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit this vulnerability via a crafted HTML page to bypass system access restrictions . Chromium assigned it a Medium security severity. The fix is available in ...

CVE-2026-79120

CVE-2026-79120 is an uninitialized resource flaw in ANGLE within Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit it via a crafted HTML page to potentially obtain cross-origin data . Chromium classifies the severity as Medium . The fix is included in Chrome 152.0.797...

CVE-2026-79006

A protection mechanism failure in the HttpsUpgrades component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass the web origin policy by sending crafted network traffic. The Chromium team rated the severity as Medium . Users should update to version 152.0.7977.65...

CVE-2026-78966

CVE-2026-78966 is an externally controlled reference vulnerability in the QUIC component of Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit this via a crafted HTML page to bypass the web origin policy , potentially accessing cross-origin data that should be restrict...

CVE-2026-79106

Google Chrome prior to 152.0.7977.65 is affected by an improper input validation flaw in the Input component. A remote attacker who had already compromised the renderer process and leveraged social engineering could bypass the web origin policy using a crafted HTML page. The Chromium security tea...

Exploit-Medium-CVE-2021-41184

Exploit-Medium-CVE-2021-41184 Exploit Medium CVE-2021-41184 XSS in the of option of the .position util 1. jQuery ui 버전 v1.12.1 취약 1.1 https://www.website.com/js/jquery/jquery-ui-1.12.1/jquery-ui.min.js ------------------------------------------------개념...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler 持久化与 CVE-2024-49039：任务计划程序中的一个攻击面 WPTaskScheduler.dll 是任务计划程序的一个组件，自 Windows 10 1507 版本起存在。 这很可能是一个用于持久化的后门工具，经安全研究人员分析， 发现它能够绕过受限令牌沙箱、子进程限制，并提升至中等完整性。 ??? 1: 建立 RPC 连接，但受限令牌（如 Google Chrome 渲染器进程）似乎无法建立 RPC 连接， 因此它可能没什么用？不过 audio.mojom.AudioService 和 gpu-process 的绕过成功了…… 2: 似乎...

pharmacy-sqli-CVE-2026-7392

Système de Ventes et d'Inventaire de Pharmacie 1.0 - CVE-2026-7392 Injection SQL SourceCodester Système de Ventes et d'Inventaire de Pharmacie V1.0 version PHP/MySQL pure CVE : CVE-2026-7392 Point de terminaison : /ajax.php?action=deletesupplier paramètre id Type : SQL Injection CWE-89 CVSS 3.1 :...

Thruk-CVE-2023-34096

Thruk-CVE-2023-34096 Версии = v3.06 веб-интерфейса мониторинга Thruk уязвимы к CVE-2023-34096 Path Traversal. Текущий эксплойт написан на Python 3 и использует эту уязвимость для загрузки PoC-файла в несколько стандартных каталогов Thruk, а также в некоторые каталоги Linux. CVSS CNA GitHub, Inc...

phpMyAdmin <4.8.5 - Local File Inclusion

phpMyAdmin before 4.8.5 is susceptible to local file inclusion. When the AllowArbitraryServer configuration setting is set to true, an attacker can read, with the use of a rogue MySQL server, any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfi...

WordPress CTHthemes - Cross-Site Scripting

WordPress CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes contain reflected cross-site scripting vulnerabilities via a search query. id: CVE-2019-20210 info: name: WordPress CTHthemes - Cross-Site Scripting author: edoardottt severity: medium description: |...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

Nagios XI <5.8.5 - Open Redirect

Nagios XI through 5.8.5 contains an open redirect vulnerability in the login function. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-29272 info: name: Nagios XI 5.8.5 - Open Redirect...

Duplicator < 1.4.7.1 - Information Disclosure

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. id: CVE-2022-2552 info: name: Duplicator 1.4.7.1 - Information Disclosure author:...

OpenCATS 0.9.6 - Cross-Site Scripting

OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/ssl-provider.php ssl-provider-name and ssl-provider's-url parameters. id: CVE-2018-20009 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD...

SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. id: CVE-2017-18518 info: name: SMTP by BestWebSoft 1.1.0 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. impact: |...