CVE-2024-50969

CVE-2024-50969 描述 Code-projects Jonnys Liquor 1.0 中 browse.php 存在反射型跨站脚本（XSS）漏洞，远程攻击者可通过 search 参数注入任意 Web 脚本或 HTML。 漏洞类型 跨站脚本 XSS 产品供应商 Code-projects 受影响产品代码库： https://code-projects.org/jonnys-liquor-in-php-css-javascript-and-mysql-free-download/ - 1.0 受影响组件： browse.php 攻击向量： 1. 在本地搭建应用程序 2...

CVE-2025-7753

🚨 CVE-2025-7753 — SQL 注入 PoC 利用工具 作者: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 漏洞类型: 未认证的基于时间的 SQL 注入 🔍 概述 在 在线预约系统 1.0 （Code‑Projects）中的 /admin/adddoctor.php 文件存在一个严重的 SQL 注入漏洞。username 参数未正确过滤，允许远程攻击者执行任意 SQL 查询（基于时间、基于错误、联合查询、布尔盲注）。 本仓库提供了 首个公开的 PoC ，使用 C 语言编写，利用 libcurl 进行 HTTP...

CVE-2024-57487-and-CVE-2024-57488

Vulnerabilidades del Sistema de Alquiler de Coches en Línea Este repositorio contiene detalles sobre las vulnerabilidades identificadas en el proyecto Online Car Rental System de Code-Projects, Versión 1.0. A las vulnerabilidades se les han asignado CVEs e incluyen informes completos para ayudar ...

CVE-2019-1388

Proyectos CVE...

CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit

CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit Serverless Framework MCP Server CVE-2025-69256 Puntuación base: 9,4/10 → Puntuación CTT mejorada: 9,9/10 Una vulnerabilidad crítica de inyección de comandos en el servidor MCP Model Context Protocol de Serverless Framework,...

cve-lite-on-pi

cve-lite-on-pi Un breve informe sobre la ejecución de CVE Lite CLI contra el monorepositorio pi , y lo que encontró. Antecedentes Este experimento fue motivado por el artículo "OWASP CVE Lite CLI – Nueva herramienta para escanear vulnerabilidades en tus proyectos" CyberSecurityNews. ¿Qué es CVE...

EUVD-2026-90000

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects...

CVE-2026-85706

CVE-2026-85706 Lectura arbitraria de archivos sin autenticación en GitLab ★ PoC de lectura arbitraria de archivos sin autenticación en GitLab CVE-2026-85706 ★ https://github.com/user-attachments/assets/026749ec-04e9-4dd5-9453-cb7c1f6e823d Descripción general CVE-2026-85706 es una lectura arbitrar...

CVE-2026-100256: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

EUVD-2026-88817

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an incorrect authorization check that allows an authenticated user with only read permission for a project to modify a workflow instance. By accessing the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to e...

CVE-2026-71898: Incorrect Authorization

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-101105

The Matrimonial System 1.0 (code-projects) is vulnerable to a remote SQL injection in the Profile Creation Endpoint . The flaw exists in the processprofile_form function within the /create_profile file, specifically caused by the improper handling of the fname argument. An attacker can exploit th...

Exploit for Path Traversal in Gitlab

CVE-2026-85706 GitLab unauthenticated arbitrary file read ★ C...

CVE-2026-76910

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-77425

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...