229 matches found
CVE-2022-44268-MagiLeak
ImageMagick Arbitrary Read Files - CVE-2022-44268 Этот репозиторий содержит код доказательства концепции PoC для эксплуатации уязвимости произвольного чтения файлов CVE-2022-44268 в ImageMagick. PoC демонстрирует, как злоумышленник может использовать уязвимость для чтения произвольных файлов в...
Twitter-Info
Twitter Info Простой Python-скрипт для получения информации об аккаунте Twitter, например: Имя Подписки Подписчики Лайки Дата создания аккаунта Фото профиля просто по имени пользователя или ссылке на профиль. Использование python3 twitterinfo.py or Пример Ввод python twitterinfo.py ngll Вывод Nam...
UBUNTU-CVE-2026-91838
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...
CVE-2026-91838
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...
CVE-2026-91838
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...
PT-2026-95767
Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin versions prior to 1.2.3 Description Authenticated users with a host role can modify profile data of other hosts and reassign ownership of those records to themselves...
CVE-2026-92421: Authorization Bypass Through User-Controlled Key
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Protection was added to the device queue against concurrent access. In the dasdprofilestart function, the number of requests on the device queue is counted. However, access to the device queue is not protected against...
Improper Input Validation
github.com/free5gc/free5gc is vulnerable to improper input validation. The vulnerability is due to insufficient validation of NF Profile data, which allows an attacker with SBI access to submit malicious profiles containing attacker-controlled network-function endpoints, causing them to be...
CVE-2026-77135
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...
CVE-2026-77135 Information Disclosure in extension "femanager" (femanager)
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...
EUVD-2026-65341
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...
PT-2026-81235
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The user detail view of the extension does not verify if the requested user record matches the configured or logged-in target. This allows visitors with access t...
CVE-2026-77135: Authorization Bypass Through User-Controlled Key
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...
CVE-2026-74869 stoatchat before 0.15.0 Missing Authorization via Subscribe
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sendin...
CVE-2026-74869
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sendin...
CVE-2026-74869
StoatChat before version 0.15.0 has a missing-authorization flaw in the Subscribe message handler: authenticated users can send a Subscribe message with any arbitrary server ID and receive live UserUpdate events (display names, avatars, status) for members of private servers they are not part of....
CVE-2026-73488
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...
CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...
EUVD-2026-57804
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...