CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 plantilla nuclei Joomla CVE-2023-23752 - un parámetro de solicitud bypasea la API Rest Versiones afectadas ​ Joomla tiene aproximadamente tres entradas de enrutamiento, que son 1. index.php en el directorio raíz usuarios acceden a artículos 2. administrator/index.php...

extended-ssrf-search

Búsqueda extendida de SSRF Esta herramienta busca SSRF utilizando configuraciones predefinidas en diferentes partes de una solicitud ruta, host, encabezados, parámetros POST y GET. Primer paso Renombra example.app-settings.conf a app-settings.conf y ajusta la configuración. El ajuste más importan...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versiones anteriores a 1.13 hasta 1.13.10, 2.0 hasta 2.0.5, y versiones antiguas no soportadas, contienen una vulnerabilidad de enlace de propiedades causada por una neutralización incorrecta de elementos especiales. Un usuario malintencionado remoto no...

Jenkins-CVE-2024-23897-Lab

Jenkins CVE-2024-23897 Laboratorio Vulnerabilidad de lectura de archivos arbitrarios en Jenkins 2.441 y anteriores. Ejecución root@kitploit: docker-compose up -d Ataque automático root@kitploit: docker exec -it attacker-host ./auto-exploit.sh Ataque manual root@kitploit: docker exec -it...

CVE-2026-85196

CVE-2026-85196 affects the Articles Anywhere Pro (versions < 20.0.0) and Users Anywhere Pro (versions

CVE-2025-52289

CVE-2025-52289: Control de Acceso Roto en MagnusBilling v7.8.5.3 Descripción Existe una vulnerabilidad de Control de Acceso Roto en MagnusBilling en versiones anteriores a v7.8.5.3. Los usuarios recién registrados pueden escalar el estado de su cuenta de pending a active sin la aprobación del...

CVE-2026-75953

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-17079

CVE-2026-17079 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The issue allows a remote authenticated attacker to bypass security restrictions by disabling server-side input validation through a request parameter. The root cause is improper input validation control that can be manipulat...

EUVD-2026-51014

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

EUVD-2026-41060

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php line 16: SELECT id, filename, extension, type FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract database contents...

CVE-2026-52784

CVE-2026-52784 (OpenProject) is a CSRF vulnerability in OpenProject’s web UI. The issue allows CSRF on a user-targeted action via POST to /users/:id with the parameter user[admin], enabling unauthorized state changes without user interaction. Affected software versions are prior to 17.3.3 and 17....

CVE-2017-20268 Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection

Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads t...

CVE-2026-34417

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to...

EUVD-2026-35910

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

PT-2026-48309

Name of the Vulnerable Software and Affected Versions Spring Security versions 7.0.0 through 7.0.5 Spring Authorization Server versions 1.5.0 through 1.5.7 Description The authorization endpoint performs insufficient validation of the request uri parameter. An attacker can craft a malicious...

CVE-2026-9422

A vulnerability was identified in KLiK SocialMediaWebsite 1.0. This issue affects some unknown processing of the component HTTP POST Request Parameter Handler. Such manipulation leads to injection. The attack can be launched remotely. The exploit is publicly available and might be used...

CVE-2026-9420

A vulnerability was found in KLiK SocialMediaWebsite 1.0. This affects an unknown part of the component HTTP GET Request Parameter Handler. The manipulation results in injection. It is possible to launch the attack remotely. The exploit has been made public and could be used...

KLiK SocialMediaWebsite 安全漏洞

KLiK SocialMediaWebsite is a simple PHP-based social media website by the individual developer Muhammad Saad. A security vulnerability exists in KLiK SocialMediaWebsite version 1.0, which originates from the HTTP GET Request Parameter Handler component and could lead to injection...

PT-2026-42998

A vulnerability was found in KLiK SocialMediaWebsite 1.0. This affects an unknown part of the component HTTP GET Request Parameter Handler. The manipulation results in injection. It is possible to launch the attack remotely. The exploit has been made public and could be used...

CVE-2026-37281

An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter...