EUVD-2026-97058

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notificati...

CVE-2026-108884 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notificati...

CVE-2026-108884 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notificati...

CVE-2026-108730

A flaw was found in Raven. Legacy application programming interface API endpoints fail to verify workspace membership when retrieving messages and shared files. An authenticated remote attacker who is not a member of a workspace can exploit this flaw using predictable channel identifiers, resulti...

CVE-2026-108566

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

EUVD-2026-96869

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

CVE-2026-108566 InstantSoft icms2 Private Message index.tpl.php index cross site scripting

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

CVE-2026-108566 InstantSoft icms2 Private Message index.tpl.php index cross site scripting

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

CVE-2026-108566

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

CVE-2026-108566 InstantSoft icms2 Private Message index.tpl.php index cross site scripting

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack c...

CVE-2026-108566

A cross-site scripting (XSS) vulnerability exists in InstantSoft icms2 versions up to 2.18.2 . The flaw is located in the index function of the templates/default/controllers/messages/index.tpl.php file within the Private Message Handler component. Improper handling of the nickname argument allows...

CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin (versions through 1.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to verify if a chat message sender belongs to the intended conversation, combined with a lack of output encoding for message content. This allows u...

posta

Posta Posta es una herramienta para investigar la comunicación de Mensajería entre Documentos Cross-document Messaging. Permite rastrear, explorar y explotar vulnerabilidades de postMessage, e incluye funciones como la reproducción de mensajes enviados entre ventanas dentro de cualquier navegador...

cryptography

pyca/cryptography .. image:: https://img.shields.io/pypi/v/cryptography.svg :target: https://pypi.org/project/cryptography/ :alt: Latest Version .. image:: https://readthedocs.org/projects/cryptography/badge/?version=latest :target: https://cryptography.io :alt: Latest Docs .. image::...

pmkidcracker

Crackeador de PMKID WPA2 Este programa es una herramienta escrita en Python para recuperar la clave precompartida de una red WiFi WPA2 sin necesidad de desautenticación ni requerir que haya clientes en la red. Aprovecha la debilidad de ciertos puntos de acceso que anuncian el valor PMKID en el...

binder-trace

Binder Trace Binder Trace è uno strumento per intercettare e analizzare i messaggi Binder di Android. Pensalo come un "Wireshark per Binder". Requisiti versione di Python = 3.9 ⚙️ Installazione Avrai bisogno di un dispositivo Android rooted o di un emulatore. solo Linux - installa xclip o xsel per...

EUVD-2026-96580

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded...

EUVD-2026-96564

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

EUVD-2026-96563

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...