CVE-2026-105610

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument...

CVE-2026-39200

CVE-2026-39200 — البرمجة النصية عبر المواقع XSS الانعكاسية في Toko Online RotI الملخص تم تحديد ثغرة برمجة نصية عبر المواقع XSS انعكاسية في معامل الطلب produk في تطبيق الويب Toko Online RotI. يفشل التطبيق في ترميز HTML للمدخلات المقدمة من المستخدم قبل انعكاسها داخل سمة وسم HTML محاطة بعلامتي اقتبا...

CVE-2026-105610 chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument...

EUVD-2026-92932

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument...

CVE-2026-105610

A vulnerability exists in chillzhuang SpringBlade up to version 5.0.1 within the Parameter Submit Management component. The flaw is located in an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java. Specifically, manipulatin...

CVE-2026-105610 chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument...

CVE-2026-105610 chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument...

CVE-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail A Path Traversal vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "plugins" parameters do not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2024-52301-Research

CVE-2024-52301-Research A bit of research around CVE-2024-52301. I've seen the vuln and wanted to find out how Laravel is vulnerable. For this, I just diffed the 6.20.44 and 6.20.45 versions, and traced how GET parameters could end up changing the application configuration. I've written about thi...

CVE-2024-4577

CVE-2024-4577: Critical Vulnerability in PHP's CGI Configurations A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters. Impacted Versions PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi. Attack Methodology...

CVE-2025-22953

CVE-2025-22953 – Epicor HCM Unauthenticated Blind SQL Injection Update – Patch Released by Epicor Epicor has officially released a patch addressing this vulnerability. All affected users are strongly advised to apply the update immediately. 🔗 Epicor Security Patch Announcement Summary An...

CVE-2026-58457

CVE-2026-58457 - शेनझेन Aitemi M300 वाई-फ़ाई रिपीटर में अनधिकृत OS कमांड इंजेक्शन !WARNING यह कोड केवल शैक्षिक और अनुसंधान उद्देश्यों के लिए AS IS प्रदान किया गया है। इस PoC का उपयोग उत्पादन प्रणालियों, साझा वातावरण, या किसी अनधिकृत लक्ष्य पर न करें। इस कोड को चलाने या होस्ट करने से एंटीवायरस...

VMware-CVE-2022-22954

VMware-CVE-2022-22954 VMware CVE-2022-22954 Workspace ONE Access Freemarker Server-Side Template Injection POC for Vmware CVE-2022-22954 Use this one line GET request!! This will execute cat /etc/passwd...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — كاميرا Hikvision IP / DVR / NVR مصادقة غير سليمة — تصعيد الامتيازات عبر معامل استعلام مُصمَّم خصيصًا | ---|--- معرّف CVE| CVE-2017-7921 فئة الثغرة| CWE-287: مصادقة غير سليمة الدرجة الأساسية CVSS v3.0| 10.0 حرجة — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H درجة CVSS v2.0| 7.5 عالية —...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

CVE-2026-105756

A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...

CVE-2026-74251

حقن SQL غير مُصادَق عبر فلتر الخصائص في Phoca Cart Phoca Cart ≤ 6.1.6 — مهاجم غير مُصادَق يستخرج قاعدة البيانات بالكامل عبر حقن أعمى قائم على الزمن الملخص يتم دمج وسيطي مصفوفة GET هما a الخاصية وs المواصفة في صفحة عناصر المتجر العامة في Phoca Cart خامًا داخل جُمل SQL WHERE دون وسم parameterizatio...

PT-2026-106314

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument...

PT-2026-106853

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...