PT-2026-81723

Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-81800

Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2025-2294

Exploit CVE-2025-4403 Dettagli Pubblicato : 27 marzo 2025 Aggiornato : 28 marzo 2025 Gravità : Critico Punteggio CVSS: 9.8 CWE : CWE-22: Limitazione impropria del percorso di un nome di file a una directory ristretta 'Path Traversal' Versioni interessate : Tutte le versioni dalla n/a fino alla...

CVE-2021-39408

CVE-2021-39408 Una vulnerabilità di Cross Site Scripting XSS riflesso esiste in più versioni 1.0 dell'applicazione Online Student Rate System che consente l'esecuzione arbitraria di comandi JavaScript. Pagina vulnerabile In index.php, il parametro page è vulnerabile, consentendo a un attaccante d...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

CVE-2024-50475

CVE-2024-50475 Signup Page = 1.0 - Aggiornamento non autenticato di opzioni arbitrarie Descrizione: Il plugin Signup Page per WordPress è vulnerabile a modifiche non autorizzate dei dati che possono portare a escalation dei privilegi a causa di un controllo delle capacità mancante in tutte le...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Forschungsnotizen Übersicht Dieses Repository enthält ein bereinigtes technisches Diagramm und unterstützende Notizen zur Linux-Kernel-Sicherheitslücke, die allgemein als Dirty Frag bezeichnet und für den xfrm-ESP-Pfad als CVE-2026-43284 verfolgt wird. Das Problem...

CVE-2026-34491

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...

Dirty-Frag

💥 CVE-2026-43284 — Dirty Frag 💥 ⚡ إثبات مفهوم لتصعيد الامتيازات المحلي عبر Dirty Frag ⚡ 📖 الوصف يحتوي هذا المستودع على إثبات مفهوم PoC لما يلي: CVE-2026-43284 — Dirty Frag يُظهر الاستغلال ثغرة تؤثر على أنظمة Linux الضعيفة. 🧠 حول Dirty Frag Dirty Frag يُشار إليها أحيانًا باسم Copy Fail 2 هي ثغرة...

EUVD-2026-65005

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...

CVE-2026-34491

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...

CVE-2026-34491

A persistent cross-site scripting (XSS) vulnerability in the web interface of Johnson Controls Metasys (a building management system) allows a low-privilege user to inject a malicious payload via a crafted URL. The payload persists across logins and executes in the browser context of other users,...

CVE-2023-44758_GDidees-CMS-Stored-XSS---Title

GDidees Gespeichertes XSS v3.0 Autor: Sergio Beschreibung: Cross Site Scripting-Schwachstelle in GDidees v.3.0 ermöglicht es einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript im Seitentitel auszuführen. Angriffsvektoren: Scripting: Eine Schwachstelle in der Bereinigung der...

CVE-2019-20372

CVE-2019-20372 Questo repository è solo a scopo educativo. /server server vulnerabile esegui ./server.sh /exploit.py script exploit esegui python3 exploit.py importante! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf https://github.com/vuongnv3389-sec/CVE-2019-20372...

CVE-2022-22706-poc

CVE-2022-22706 - Page-Cache-Schreiben Der Arm-Mali-GPU-Treiber übergibt dem Userspace eine CPU-beschreibbare Abbildung von Seiten, die er schreibgeschützt gepinnt hat, sodass ein unprivilegierter Prozess einen beschreibbaren Alias des Page-Cache erhält, der eine Datei unterstützt, die er nur mit...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 Multiple XSS Memorizzate Autore: Sergio Descrizione: Rite CMS 3.0 è affetto da una vulnerabilità multipla di Cross-Site scripting XSS memorizzato che consente agli attaccanti di eseguire codice arbitrario tramite un payload creato nei campi della Home Page nel menu di Amministrazion...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after free in Web Authentication in Google Chrome before version 149.0.7827.155 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...