DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002

fofa syntax: title="DataEase" poc: "POST /de2api/datasource/validate HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate, br, zstd sec-ch-ua: ""Google Chrome"";v=""135"", ""Not-A.Brand"";v=""8"", ""Chromium"";v=""135"" User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML...

CVE-2023-08-21-exploit

Exploit-Titel: Axigen if xhr1.readyState === XMLHttpRequest.DONE...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2025-54597 info: name: Heimdall Application Dashboard 2.7.3 - Reflected XSS author: 0xAkoko severity: medium...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

VDO.Ninja - DOM-Based Cross-Site Scripting

VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL. id: CVE-2025-62613 info: name: VDO.Ninja - DOM-Based Cross-Site Scripting author: 0xAkoko severit...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

CVE-2025-8191

CVE-2025-8191 – حقن XSS في Swagger UI الوصف : يحتوي هذا المستودع على إثبات مفهوم PoC لاستغلال الثغرة CVE‑2025‑8191، وهي ثغرة وجدت في Swagger UI. تسمح الثغرة بحقن Cross‑Site Scripting XSS في حقل “description”، مما يؤدي إلى تنفيذ سكربت عن بعد في إصدارات Swagger UI ≤ 1.0.3. المراجع : مدخل NVD:...

shlol

SHLOL Questo è un menu che puoi attivare con una combinazione di tasti per fare cose di base per te Molto facile da usare Crea listener al volo Nessun bisogno di copia e incolla Scegli il tipo, IP e PORTA e hai finito! Esegui script remoti facilmente Generatore di Reverse Shell...

ipyida

= IPyIDA IPyIDA è una soluzione basata esclusivamente su Python per aggiungere una console IPython a IDA Pro. Usa per aprire una finestra con una console Qt incorporata. Potrai quindi usufruire del completamento automatico di IPython, della guida in linea, del campo di input a caratteri...

CVE-2026-75569

mce-operator-bundle (Red Hat) contains a build-time supply chain flaw: the bundle-generation process fetches business logic from the mutable branch stolostron/release@master without commit pinning or signature verification. An attacker with write access to that remote repository can inject arbitr...

EUVD-2026-63086

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

MAL-2026-11521 Malicious code in psbt-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82a309d768af6a39f95bb4f7c9f5d8548a95f0074613985f49f0513420dae9fa The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive...

Malicious code in psbt-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82a309d768af6a39f95bb4f7c9f5d8548a95f0074613985f49f0513420dae9fa The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive...

Malicious code in psbt-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...

MAL-2026-11520 Malicious code in psbt-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...

Malicious code in wacve-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071 On import wacveutils, the package's init.py unconditionally invokes checkforupdates, which HTTP-fetches a hardcoded GitHub Gist under the user...

SUSE CVE-2026-17724

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-17728

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...