Exploit for Code Injection in Xwiki

CVE-2025-24893 — XWiki Unauthenticated RCE PoC Proof-of-Con...

ClickFix Malware Campaign Exploits CAPTCHAs to Spread Cross-Platform Infections

A combination of propagation methods, narrative sophistication, and evasion techniques enabled the social engineering tactic known as ClickFix to take off the way it did over the past year, according to new findings from Guardio Labs. "Like a real-world virus variant, this new 'ClickFix ' strain...

CVE-2025-8555 atjiu pybbs search cross site scripting

A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulation of the argument keyword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to...

Attack the Messages, Not the Agents: a Multi-Round Adaptive Stealthy Tampering Framework for LLM-MAS

Large language model-based multi-agent systems LLM-MAS effectively accomplish complex and dynamic tasks through inter-agent communication, but this reliance introduces substantial safety vulnerabilities. Existing attack methods targeting LLM-MAS either compromise agent internals or rely on direct...

pybbs 代码注入漏洞

pybbs is a community platform for Java development by iuiu individual developers. A code injection vulnerability exists in pybbs 6.0.0 and earlier versions, which stems from improper handling of the parameter keyword in the file /search, and could lead to a cross-site scripting attack...

SUSE CVE-2025-4981

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequence...

CVE-2025-53395

Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx...

PT-2025-31854 · Unknown +1 · Vsssvr.Dll +2

Name of the Vulnerable Software and Affected Versions: Macrium Reflect versions through 2025-06-26 Description: Macrium Reflect allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory...

CVE-2025-53395

Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx...

Exploit for CVE-2024-32019

⚠️ CVE-2024-32019 - PoC 📌 Affected Versions - = v1.45.0...

Code-Projects Online Medicine Guide 注入漏洞

Code-Projects Online Medicine Guide is an online medicine guide from Code-Projects open source. An injection vulnerability exists in Code-Projects Online Medicine Guide version 1.0, which stems from SQL injection due to incorrect manipulation of the parameter Search in the file /cusfindphar2.php...

Exploit for Code Injection in Xwiki

Infos This PoC first tests for the SSTI and if it works. It...

OpenAI kills “short-lived experiment” where ChatGPT chats could be found on Google

A little-known ChatGPT "feature" is now gone. It could be a good thing. On X, OpenAI Chief Information Security Officer Dane Stuckey announced that OpenAI "removed a feature from ChatGPT that allowed users to make their conversations discoverable by search engines, such as Google." Stuckey called...

Autodesk Navisworks Manage 2026 Untrusted Search Path (adsk-sa-2025-0014)

The version of Autodesk Navisworks Manage installed on the remote host may be affected by a vulnerability as referenced in the adsk-sa-2025-0014 advisory. - A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary...

PT-2025-32598 · Maven · Org.Opensearch.Plugin:Opensearch-Security

Impact OpenSearch versions 2.19.2 and earlier improperly apply field masking rules on fields of the types ip, geo point, geo shape, xy point, xy shape. While the content of these fields is properly redacted in the source document returned by search operations, the original unredacted values remai...

Autodesk Revit 2026 < 2026.0.2 Untrusted Search Path (adsk-sa-2025-0014)

The version of Autodesk Revit installed on the remote host is 2026 prior to 2026.0.2. It is, therefore, affected by a vulnerability as referenced in the adsk-sa-2025-0014 advisory. - A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead t...

CVE-2024-43018

Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters maxlevel and minregister. These parameters are used in wsusergerList function from file include\wsfunctions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in...

CVE-2025-25011

CVE-2025-25011 affects Elastic Beats (notably Filebeat) installed via Windows, where the Windows install script can trigger an Uncontrolled Search Path Element leading to Local Privilege Escalation through insecure directory permissions. Affected versions include Beats prior to 9.1.0 (with mainte...

CVE-2025-25011 Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer

An uncontrolled search path element vulnerability can lead to local privilege Escalation LPE via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files,...

CVE-2025-0712 APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer

An uncontrolled search path element vulnerability can lead to local privilege Escalation LPE via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files,...