CVE-2025-10503

creationtimestamp| type| source ---|---|--- 2026-04-29 10:27:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkmv737e3m2o...

CVE-2026-3325

SQL injection SQLi in MegaCMS v12.0.0, specifically in the “idterritorio” parameter of the “/webcomunications/cms/getprovincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “idterritorio” parameter, used...

EUVD-2026-26199

SQL injection SQLi in MegaCMS v12.0.0, specifically in the “idterritorio” parameter of the “/webcomunications/cms/getprovincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “idterritorio” parameter, used...

CVE-2026-3325

MegaCMS v12.0.0 is affected by a SQL injection in the /web_comunications/cms/get_provincias endpoint, via the POST parameter id_territorio after the registration form submission. The vulnerability stems from insufficient validation/sanitisation of user input, allowing an unauthenticated attacker ...

chrome-exploit-simulator

Ethical Hacking — Simulateur Exploit Web Présentation Ce...

CVE-2026-6429

creationtimestamp| type| source ---|---|--- 2026-04-29 07:10:54+00:00| seen| https://mastodon.social/users/bagder/statuses/116486743707813679 2026-04-29 07:11:04+00:00| seen| https://bsky.app/profile/bagder.mastodon.social.ap.brid.gy/post/3mkmkagqvtir2 2026-04-29 07:16:06+00:00| seen|...

CVE-2026-35155

creationtimestamp| type| source ---|---|--- 2026-04-29 06:46:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkmitzi7m32k 2026-04-30 04:32:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116491781721170939...

CVE-2026-1460

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX3301-T0 firmware versions through 5.50ABVY.7.1C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected...

CVE-2026-7320

creationtimestamp| type| source ---|---|--- 2026-04-29 05:55:52+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-mozilla-4 2026-04-29 12:50:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkn577kg6v2w 2026-05-04 15:30:07+00:00| seen|...

CVE-2026-42248

creationtimestamp| type| source ---|---|--- 2026-04-29 03:55:00+00:00| seen| https://cert.pl/en/posts/2026/04/CVE-2026-42248 2026-04-29 15:21:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknfmvzbop2o 2026-05-10 11:02:10+00:00| seen|...

CVE-2025-53209

creationtimestamp| type| source ---|---|--- 2026-04-29 02:14:25+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mklzo3le4i2s 2026-06-02 11:29:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mncijlw2kk2o 2026-06-02 14:04:59+00:00| seen|...

Helpy 跨站脚本漏洞

Helpy is an open-source customer support application developed by the American company Helpy. This program includes features such as a knowledge base, community discussions, and email support. Version 2.8.0 of Helpy contains a cross-site scripting vulnerability, which stems from the storage-based...

PT-2026-35947

Name of the Vulnerable Software and Affected Versions SonicOS affected versions not specified Description A post-authentication stack-based buffer overflow allows a remote attacker to crash a firewall. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the...

Hermes Agent 后置链接漏洞

Hermes Agent is an AI agent tool developed by Nous Research, featuring self-learning capabilities. Version 0.8.0 of Hermes Agent has a post-link vulnerability, which stems from improper handling of the checksensitivepath function in the tools/filetools.py file. This vulnerability may lead to...

PT-2026-35991

BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field hiddenfile and field deleteimg parameters during profile editing to unlin...

TÜBİTAK BİLGEM Pardus About 后置链接漏洞

TÜBİTAK BİLGEM Pardus About is a component module of the Turkish company TÜBİTAK BİLGEM that provides functionality for displaying operating system information and system descriptions. Versions of TÜBİTAK BİLGEM Pardus About prior to 1.2.1 had a post-link vulnerability; this vulnerability stemmed...

PT-2026-35976

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline path parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to...

PT-2026-35946

Name of the Vulnerable Software and Affected Versions SonicOS affected versions not specified Description A post-authentication Path Traversal issue allows an authenticated attacker to interact with services that are typically restricted. Path Traversal is a flaw that enables attackers to access...

CVE-2026-6551

creationtimestamp| type| source ---|---|--- 2026-04-28 23:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mklqnmviap2a 2026-04-29 13:44:53+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mknaapny5o2u...

FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field

Summary The application fails to validate the nick parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account including the Administrator. This leads to Broken Access Control and...