CVE-2024-0710

CVE-2024-0710 Vulnerabilità: CVE-2024-0710 Modifica non autenticata dell'ID univoco di invio del modulo CVSS: 5.3 Medio Software: GP Unique ID gp-unique-id Versioni interessate: = 1.5.5 Versione corretta: 1.5.6 Sviluppatore: Gravity Wiz Ricercatore: Karl Emil Nikka, Nikka Systems Pubblicato...

CVE-2026-77128

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

EUVD-2026-65351

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...

CVE-2026-77128

TYPO3 extension sf_event_mgt (Event management and registration) has a Broken Access Control vulnerability where the extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-res...

CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

EUVD-2026-65347

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

Rently Smart Home

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize...

log4shell-example

Test dell'Exploit Log4Shell L'obiettivo di questo progetto è dimostrare la vulnerabilità di exploitation di log4j cve-2021-44228 in un ambiente spring-boot e mostrare come risolverla. Questo progetto contiene tre sottomoduli. Uno di questi contiene codice vulnerabile, gli altri due sono corretti...

CVE-2026-0257-PoC

CVE-2026-0257 — PAN-OS GlobalProtect प्रमाणीकरण बाइपास रिमोट डिटेक्शन PoC केवल डिटेक्शन। कोई शोषण नहीं। कोई क्रेडेंशियल सबमिट नहीं किए गए। कोई कुकीज़ जाली नहीं बनाई गईं। अवलोकन CVE-2026-0257 एक प्रमाणीकरण बाइपास भेद्यता है CWE-565 — वैलिडेशन और इंटीग्रिटी जांच के बिना कुकीज़ पर निर्भरता जो Palo...

CVE-2026-74252

XSS Armazenado no Checkout de Convidado do J2Commerce via Bypass do Filtro de Cookie J2Commerce comj2store ≤ 4.1.5 — Atacante não autenticado armazena payload XSS que é executado automaticamente no navegador do administrador ao carregar a página RESUMO O J2Commerce 4.1.5 é vulnerável a Cross-Site...

CVE-2026-59230

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

CVE-2026-59230

Apache Camel's camel-mail component (MimeMultipart data format) is vulnerable to header injection when headersInline is explicitly set to true. During unmarshalling, MIME headers from the incoming message are copied onto the Camel Exchange via setHeader without a HeaderFilterStrategy, allowing a ...

forbidden

Forbidden Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client. Tested on Kali Linux v2024.2 64-bit. Made for educational purposes. I hope it will help! Future plans: Add the silent option to suppress console output. Add the no color option...

MAL-2026-14401 Malicious code in multyproccess (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553 The package's setup.py overrides the install and develop cmdclass to base64-decode a bundled request/.payload file and launch it via...

CVE-2026-49086

camel-dapr Consumer-Routing-Header-Override / Confused-Deputy-Reproducer CVE-2026-49086 Dieses Projekt demonstriert einen Routing-Header-Override- Confused-Deputy-Fehler in der camel-dapr-Komponente von Apache Camel, der als CVE-2026-49086 verfolgt wird. Der Dapr-Pub/Sub-Consumer DaprPubSubConsum...

CVE-2026-65694-PoC

CVE-2026-65694 — Lettura arbitraria di file non autenticata in Microweber CMS Proof-of-concept per CVE-2026-65694 , una lettura arbitraria di file non autenticata tramite path traversal in Microweber CMS. Un utente non autenticato può leggere qualsiasi file accessibile all'utente del web server —...

spring-boot-cve-2022-22965

= Esempio di override della versione di Spring Framework Questo repository mostra come eseguire l'override della versione di Spring Framework in un'applicazione basata su Spring Boot 2.4. Spring Boot 2.4.x è https://spring.io/projects/spring-bootsupportfuori dal supporto OSS, l'ultima versione è...

CVE-2026-54457

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

EUVD-2026-64063

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...