CVE-2025-52289

CVE-2025-52289: Broken Access Control in MagnusBilling v7.8.5.3 Description A Broken Access Control vulnerability exists in MagnusBilling versions prior to v7.8.5.3. Newly registered users can escalate their account status from pending to active without administrator approval by modifying a reque...

extended-ssrf-search

Extended ssrf search This tool search for SSRF using predefined settings in different parts of a request path, host, headers, post and get parameters. First step Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend ...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

Jenkins-CVE-2024-23897-Lab

Jenkins CVE-2024-23897 Lab Arbitrary file read vulnerability in Jenkins 2.441 and earlier. Launch docker-compose up -d Automated Attack docker exec -it attacker-host ./auto-exploit.sh Manual Attack docker exec -it attacker-host bash cd /tmp curl -o jenkins-cli.jar...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 nuclei template Joomla CVE-2023-23752 - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are 1. index.php in the root directory users access articles 2. administrator/index.php in the root directory...

CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

Security Bulletin: vulnerability detected in informixhq-server

Summary Vulerabiltity in web component [email protected] Vulnerability Details CVEID:CVE-2026-84363 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as...

EUVD-2015-9439

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CVE-2015-20130

Netsweeper versions before 4.0.11 and 4.1.0 before 4.1.5 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the webadmin/reporter/view_server_log.php component. The root cause is the lack of proper output encoding when handling the log request parameter. Remote attackers ca...

CVE-2015-20130 Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

VulnCheck KEV: CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

PT-2026-133615

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view server log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the...

CVE-2015-20130: Netsweeper: Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CVE-2026-113667

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

CVE-2026-113667

ApostropheCMS, an open-source Node.js content management system, contains a vulnerability in three CAPTCHA integrations: Form , login-recaptcha , and login-hcaptcha . The flaw exists because these components interpolate an unencoded user-supplied response token into the provider verification requ...

CVE-2026-113667

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...

PT-2026-118468

Configurable Reports block for Moodle moodle-block configurablereports before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can...