483 matches found
security-advisories
🔐 Minhajul Taivin によるセキュリティアドバイザリ 私が公開したCVE情報開示の公式リポジトリへようこそ。 このリポジトリには、私が発見した脆弱性に関する詳細なセキュリティアドバイザリ、概念実証（PoC）情報、緩和策、および技術的分析が含まれています。 📌 公開済みのCVE 1️⃣ CVE-2025-63892 — SourceCodester Student Grades Management System における格納型XSS 📄 アドバイザリ: CVE-2025-63892.md...
CVE-2026-82701
A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...
EUVD-2026-68594
A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...
rConfig_rce
rConfig 3.9 SQLインジェクションとコマンドインジェクションの複合PoC 概要 このPoCはrConfigバージョン3.9.4を対象とし、SQLインジェクションとリモートコマンドインジェクションの脆弱性を組み合わせたエクスプロイトを実証します。以下の処理を自動化します： 1. SQLインジェクションによるデータベース名の抽出 2. データベースからのユーザー資格情報のダンプ 3. hashcatとrockyouワードリストおよびbest64.rulesを用いたパスワードハッシュのクラック試行 4...
EUVD-2026-60168
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection...
EUVD-2018-21765
Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash...
CVE-2018-25238
VSCO 1.1.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string through the search functionality. Attackers can paste a buffer of 5000 characters into the search bar and navigate back to trigger an application...
PT-2026-30364
Microsoft FastTube 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 1900 characters into the search bar and trigger a crash when the search...
PT-2026-30361
Microsoft Watchr 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 8145 characters into the search bar and trigger a search operation to caus...
EUVD-2026-8848
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed. This issue was fixed in [email protected]...
CVE-2026-1198 SQL Injection in SIMPLE.ERP
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed. This issue was fixed in [email protected]...
CVE-2019-25367 ArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interface
ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface index.html through search, user management, and API parameters. Attackers can inject scripts via parameters in /db/system/admin/aardvark/index.html to execute JavaScript i...
CVE-2026-23492
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...
CVE-2019-18205
Multiple Reflected Cross-site Scripting XSS vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input encoded in base64. This also applies to the search functionality for the searchKey parameter...
CVE-2024-39817
Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user does not have access by conducting 'search' under certain conditions in Custom App...
EUVD-2007-2316
Malware in sbrugna...
EUVD-2014-2078
Malware in sbrugna...
EUVD-2005-4853
Malware in sbrugna...