EUVD-2026-104121

A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/productshandler.php?action=save of the component Product Management. Executing a manipulation of the argument ProductId/ProductName can lead to cross site scripting. The attack may be...

CVE-2026-91046

The ElementsReady Addons for Elementor WordPress plugin, in versions through 6.7.2 , is vulnerable to an improper access control issue. The plugin fails to perform sufficient authorization checks within several of its settings-save handlers . This oversight allows users with subscriber-level acce...

CVE-2026-91046 ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin...

rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

CVE-2017-0261

CVE-2017-0261 and Exploit Sample Analysis 0x01 Vulnerability Description Cause: When opening an Office document, FLTLDR.EXE is used to render an embedded EPS file containing the vulnerability. The file is written in PostScript language and can be exploited by an attacker through a "save-restore"...

EUVD-2025-26311

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack may be performed from remote...

tiktok-scraper

TikTok Scraper & Downloader Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Content Features To Do Contribution...

CVE-2025-65950

CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups Parameter Overview Field| Details ---|--- CVE ID| CVE-2025-65950 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products WBCE/WBCECMS Details Summary A critical SQL Injection...

CVE-2021-21123-PoC-Google-Chrome

📝 Description Google Chrome - File System Access API - vulnerabilities reported by Maciej Pulikowski Total Bug Bounty Reward: $5.000 This is Proof of Concept for: Google SecuritySeverity CVE HIGH CVE-2021-21123 MEDIUM CVE-2021-21129 MEDIUM CVE-2021-21130 MEDIUM CVE-2021-21131 MEDIUM CVE-2021-2117...

CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

EUVD-2026-103960

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2025-31644

CVE-2025-31644: Command Injection in Appliance mode in F5 BIG-IP The “file” parameter of the “save” command is vulnerable to a command injection attack, allowing an authenticated attacker with administrator privileges to the “/mgmt” web API or the SSH “tmsh” shell, to obtain remote code execution...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

CVE-2026-110287

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...

EUVD-2026-102874

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...

CVE-2026-110287

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...

CVE-2026-110287

An improper access control vulnerability in Devolutions Server 2026.3.8.0 and earlier versions allows an authenticated user with general Edit privileges, but lacking specific Edit asset permissions, to modify the asset contact password . This is achievable by sending a crafted direct request to t...

save-pixels-updated

This is an updated version of save-pixels which patches the CVE-2020-8175 security issue. At the time of creation, every file is the same as the ones from the original repository, excluding the package.json. save-pixels-updated The following is from the save-pixels GitHub page. As mentioned befor...