EUVD-2026-63793

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-77392

The "Researcher" argument in the saveUser function of /public/submit.php (SourceCodester Dynamic Input Field Generator v1.0) is passed unsanitized to SQL queries, enabling remote SQL injection. CVSS 6.3 (MEDIUM). A public PoC exploit exists at https://gist.github.com/rionyxraiza/6b22a5e02da6b8581...

CVE-2026-77392 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-76155

Datiphy Data Management Center versions v8.3.0 through v8.5.1 ship with default administrator credentials, enabling unauthenticated remote attackers to gain full administrative access. CVSS 9.3 CRITICAL; no patch or exploitation evidence provided in documents. Upgrade to a patched version or chan...

EUVD-2026-63795

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

CVE-2026-76155 Datiphy Data Management Center - Use of Default Credentials

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...

CVE-2026-42533-POC

CVE-2026-42533 nginx における認証前ヒープバッファオーバーフローおよびヒープ情報漏えい。スクリプトエンジンの2つのパス間で PCRE キャプチャ状態の保存/復元が欠落していることが原因。2つのキャプチャ参照の間で評価される正規表現の map 変数が r-captures を上書きするため、LEN パスと VALUE...

poc-CVE-2026-23489

POC CVE-2026-23489 CVE-2026-23489 GLPI「Fields」プラグイン --cookie-value COOKIEVALUE GLPI session cookie value --php PHP Raw PHP to execute on the server end statements with ';', Dropdowns...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

EUVD-2026-63796

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

CVE-2026-77391 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

CVE-2026-77391

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 is vulnerable to cross-site request forgery (CSRF) via an unidentified function. CVSS 4.0 scores it MEDIUM (5.3); the attack is remote, requires no privileges and passive user interaction, with integrity impact. A proof-of-...

DiscordRAT

DiscordRAT V2 Discordリモート管理ツール、完全にPython3で記述されています。 これは、20以上のポストエクスプロイテーションモジュールを備えたDiscord経由で制御されるRATです。 免責事項: このツールは教育目的のみに使用され、作者はこのツールの誤用に対して一切の責任を負いません。 セットアップガイド: まず、Discordデベロッパーポータルでボットを登録し、目的のサーバーにボットを追加する必要があります（ボットに管理者権限があることを確認してください）。 ボットが作成されたら、ボットのトークンをコピーして17行目に貼り付けます。 依存関係のインストール...

CVE-2026-77651

The arrayref crate 0.3.10 for Rust pulls in a rogue build-time dependency (arrayref-proc-macro1) that executes malicious code at compile time, registering with a C2 server to enable arbitrary code execution. The crate was unpublished from crates.io. Details: https://blog.rust-lang.org/2026/08/20/...

EUVD-2026-63779

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

SUSE CVE-2026-74942

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

SUSE CVE-2026-76033

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76034

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

SUSE CVE-2026-76035

Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76038

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...