50580 matches found
CVE-2026-40523 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SAGLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM2 and PARAM3 POST parameters. Attackers can exploit...
CVE-2026-40523
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SAGLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM2 and PARAM3 POST parameters. Attackers can exploit...
Meterpreter Bind TCP
Meterpreter bind TCP handler with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter bind TCP handler — connects to a bind payload on the target""" info =...
CVE-2026-13557
creationtimestamp| type| source ---|---|--- 2026-06-29 12:07:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpghaqx2472o...
CVE-2026-13552
creationtimestamp| type| source ---|---|--- 2026-06-29 12:05:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgh5oi7yr2n...
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
The nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a displaydata outpu...
Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...
PYSEC-2026-347 Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...
PYSEC-2026-401 parisneo/lollms vulnerable to stored XSS in the social feature
A Stored Cross-Site Scripting XSS vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the...
Cross-site Scripting (XSS)
Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the DBPost model without...
parisneo/lollms vulnerable to stored XSS in the social feature
A Stored Cross-Site Scripting XSS vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the...
pgAdmin 4 Vulnerable to Remote Code Execution
Remote Code Execution security vulnerability in pgAdmin 4 Query Tool and Cloud Deployment modules.The vulnerability is associated with the 2 POST endpoints;/sqleditor/querytool/download, where the querycommited parameter and/cloud/deploy endpoint, where the highavailability parameter isunsafely...
CVE-2026-13564 Edimax EW-7478APC POST Request formPPPoESetup stack-based overflow
A vulnerability was found in Edimax EW-7478APC 1.04. Affected is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in stack-based buffer overflow. The attack can be initiated remotely...
CVE-2026-13564
Summary: CVE-2026-13564 affects Edimax EW-7478APC firmware 1.04, specifically the POST Request Handler’s formPPPoESetup function. Manipulating the pppUserName argument triggers a stack-based buffer overflow, enabling remote attacker access. Public exploit reportedly exists and the vendor did not ...
CVE-2026-13549
creationtimestamp| type| source ---|---|--- 2026-06-29 11:43:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfw2fged2g...
CVE-2026-13545
creationtimestamp| type| source ---|---|--- 2026-06-29 11:42:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfteuir722 2026-06-29 13:10:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpgkqq5efv2q 2026-06-29 15:28:58+00:00| seen|...
CVE-2026-42012
creationtimestamp| type| source ---|---|--- 2026-06-29 11:40:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfqrgxrk2t...
CVE-2026-57966
creationtimestamp| type| source ---|---|--- 2026-06-29 11:39:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfpcr2yi2n...
CVE-2026-13547
creationtimestamp| type| source ---|---|--- 2026-06-29 11:39:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgfokrgn22t 2026-06-29 13:12:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpgkvbuvax2o...
CVE-2026-9267
creationtimestamp| type| source ---|---|--- 2026-06-29 11:37:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgflplwkg2e 2026-06-29 20:46:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphea6t3zs2d...