159532 matches found
CVE-2026-108555
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer.setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind...
CVE-2026-108545
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...
CVE-2026-108555
The PairDrop application (versions through 1.11.2 ) is vulnerable to an IP spoofing issue within the Peer._setIP function. This vulnerability stems from the software's reliance on the cf-connecting-ip header, which allows remote attackers to provide a forged header. If an attacker knows a victim'...
CVE-2026-108545
SillyTavern versions 1.12.13 through 1.19.0 are vulnerable to a pre-authentication Denial of Service (DoS) . The root cause is that body-parser middleware executes before authentication and whitelist checks, allowing unauthenticated remote attackers to submit large or compressed JSON or urlencode...
CVE-2026-108546
Spotweb through version 1.5.8 is vulnerable to an OS command injection vulnerability within the runcommand NZB handler . The root cause is the unescaped substitution of shell metacharacters in a spot title for the $SPOTTITLE variable, which is subsequently passed to the exec() function. Remote at...
EUVD-2026-96340
SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...
EUVD-2026-96317
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,...
CVE-2026-49975-POC
CVE-2026-49975 — PoC HTTP/2 Bomb Эксплойт-концепт для CVE-2026-49975 — удалённая уязвимость типа «отказ в обслуживании» в реализациях сервера HTTP/2. Обнаружена Куангом Луонгом Calif Security Research, раскрыта 2 июня 2026 года. Только для авторизованного тестирования безопасности. Не используйте...
CVE-2021-32161
..| XSStoCommandInjection2 |.. 설명 : 반사형 크로스 사이트 스크립팅 XSS 공격을 악용하여 Webmin의 파일 관리자 기능을 통해 명령 삽입을 유도합니다. 테스트 버전 : Webmin 1.973 GitHub의 최신 버전 07/03/2021 공격 유형: 원격 영향 : 명령 실행 eXploit's C0de POC : 제품 공급업체 : https://www.webmin.com 추가 정보 : "Webmin은 Unix 계열 서버 및 서비스를 위한 웹 기반 시스템 관리 도구로, 전 세계적으로 1,000,000개...
The vulnerability of the ReadyScript e-commerce management system lies in the improper implementation of the sequence of actions to be performed, which allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the ReadyScript e-commerce management system is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...
The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.
The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...
The vulnerability of the Shtab project and task management service, related to deficiencies in access control, allows a intruder to gain unauthorized access to protected information.
The vulnerability of the Shtab project and task management service is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of the software for centralized printer and MFP supervision, related to inconsistencies in responses to incoming requests, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the software for centralized printer control and the Printsupervision printer system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...
The vulnerability of the TOPAZ Metron PTS time synchronization device, related to the failure to implement measures to neutralize special elements, allows intruders to inject arbitrary OS commands.
The vulnerability of the TOPAZ Metron PTS time synchronization device is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary OS commands...
The vulnerability of the “Tekon” SCADA system, which exists due to the lack of measures to neutralize specific elements, allows for the execution of arbitrary codes.
The vulnerability of the “Tekon” SCADA system exists due to the lack of measures taken to neutralize specific elements within it. Exploiting this vulnerability allows a remote attacker to execute arbitrary codes...
The vulnerability of the “Tekon” SCADA system, related to the incorrect assignment of permissions for critical resources, allows for the increase of its privileges.
The vulnerability of the “Tekon” SCADA system is related to the incorrect assignment of permissions for critical resources. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
The vulnerability of the TrueConf Server software, related to deficiencies in the authentication process, allows a perpetrator to obtain a token with administrator privileges.
The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain an administrator-level token...
The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in improper code generation management, allowing attackers to execute arbitrary code.
The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system is related to improper code generation. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.
The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...
The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system, which stems from the lack of authentication for a critical function, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to compromise the confidentiality, integrity, and accessibility o...