19427 matches found
CVE-2018-7935
CVE-2018-7935 POC grab vaild Session first curl http://192.168.8.1/html/index.html | grep SessionID Instructions: Edit exploit.py , insert grabbed SessionID Vulnerability Status : Acknowledgemnt Recieved & Patch is released...
IoCs
IoCs Sophos-originated indicators-of-compromise from published reports /@&&@ . @ @ %@%, ./&@@&@@@@ @@ @%&@@& .@, @. @ @% @ && %@ .@@@@. &@&@//@& @/ @ @@ @ %@. ,%@@@@@@@@@&/ ., @% @@ @@,&@@ ,@ .@. @ , @& ,@@@@& .@ @ .@. @ .@ @& @@. %@@% ./. @,...
CVE-2026-63030
Wordpress Core / SQLi 6.9.0 - 6.9.4 7.0.0 - 7.0.1 PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...
CVE-2004-2549
CVE-2004-2549 Nortel Wireless LAN Access Point 2200 Series - Denial of Service Exploit-db publication at https://www.exploit-db.com/exploits/23786/ Author Alex Hernandez aka @alt3kx...
security-research
Security Research Vulnerability research write-ups. Every entry here corresponds to a fixed, publicly tracked issue — no theoretical findings. Adel Bouachraoui — hydrasecurity.fr/v10/ · LinkedIn · YesWeHack Published Write-up| Target| Class| ID ---|---|---|--- When a security patch guards the wro...
CVEs
My publicly published security advisories...
CVE-2026-105267
The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...
PT-2026-107293
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The web route POST /owner/repo/tags/delete requires only write access to the Code unit. Because this route shares its handler with release deletion and fails to verify if the target is a plain...
CVE-2026-102780
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public RecordController. Its shared frontend save controller accepts the raw jform array, assigns...
CVE-2026-102780
The Joomla Extension - joomlafry.com - TF Content (versions 2.9.0 - 2.9.4 ) is vulnerable to unauthenticated cross-record publication and mass assignment . The root cause is that the public RecordController unconditionally authorizes both creation and editing actions. Additionally, the shared fro...
CVE-2026-80333
The Solace Extra WordPress plugin versions prior to 1.7.2 contains a vulnerability where it fails to perform adequate authorization or post-status checks on its front-end preview routes. This flaw allows unauthenticated visitors to access and read the rendered content of non-published posts and p...
CVE-2026-80333 Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...
CVE-2026-77255
creationtimestamp| type| source ---|---|--- 2026-09-22 22:36:08+00:00| published-proof-of-concept| https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-2xj6-xx86-cwwc 2026-09-30 15:07:11+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mwqmnjuef727...
CVE-2026-93528
creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:04+00:00| published-proof-of-concept| Telegram/dT7yXvodNHrxcxQnkvpfsJjdaGRQYlSk9Plw9VoLoilrXc 2026-09-23 00:00:28+00:00| published-proof-of-concept| Telegram/dT7yXvodNHrxcxQnkvpfsJjdaGRQYlSk9Plw9VoLoilrXc...
CVE-2026-59814 Joplin: Stored XSS via inline-served note attachment on published shares
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...
CVE-2026-55105 Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain...
CVE-2025-61682
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:24+00:00| published-proof-of-concept| https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-hg8h-557g-q8pp...
CVE-2026-63405
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:14+00:00| published-proof-of-concept| https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327 2026-09-19 15:31:24+00:00| seen| https://gist.github.com/alon710/5e8f8e10b5d10b651ea44234a36a9e37...
CVE-2026-85058
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:02+00:00| published-proof-of-concept| https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx 2026-09-19 02:31:41+00:00| seen| https://gist.github.com/alon710/6c8180b6898a74f52da1dc6d425e2b77 2026-09-24...