Microsoft-Edge-Information-Disclosure

Microsoft-Edge-Information-Disclosure CVE-2024-30056 Microsoft Edge Chromium-based Vulnerabilidad de Divulgación de Información Esta es una vulnerabilidad en Microsoft Edge Chromium-based. El atacante pudo engañar al usuario para que revelara información sensible sin su conocimiento. Poc: PoC...

CVE-2025-49113-Simulation

Roundcube RCE 实验室 CVE-2025-49113 一个动手实践的、容器化的实验室环境，用于模拟和利用 Roundcube Webmail 中一个严重的认证后 RCE 漏洞，编号为 CVE-2025-49113。 📖 关于该漏洞 本实验演示了一个针对 Roundcube 网络邮件客户端的复杂攻击链。该漏洞是一个 认证后远程代码执行 Post-Authentication RCE ，由对 PHP 会话数据的不当处理导致 PHP 对象反序列化 PHP Object Deserialization 而引发。 已认证的攻击者可以构造一个恶意的 PHP...

Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities

Summary IBM Cyber Fraud includes components with known vulnerabilities. These have been addressed in release 1.1.0. Vulnerability Details CVEID:CVE-2026-9825 DESCRIPTION: IBM Cyberfraud has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections,...

CVE-2019-5420-PoC

CVE-2019-5420-PoC Lo escribí para PentesterLab Si eres de PentesterLab, no hagas trampa, es mucho mejor aprender. Espero que le sea útil a alguien, si no a mí en el futuro : Buen material de argparse, no es un mal PoC Uso usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY VALUE...

CVE-2026-7173

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

CVE-2026-7174

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...

CVE-2026-7174 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...

CVE-2026-7174

The Entradium platform by Crocantickets is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the Name and Field parameters of the /tools/discount_wizard/discount_config endpoint during the discount creation process. Attackers can inject malicious JavaScript code...

EUVD-2026-90744

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...

CVE-2026-7173

The Entradium platform by Crocantickets contains Cross-Site Scripting (XSS) vulnerabilities. A Stored XSS exists in the City parameter of the /events//edit_general endpoint, allowing JavaScript injection that executes on an event's public page when editing events assigned to a promoter. Additiona...

CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

EUVD-2026-90743

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

Johnson Controls EasyIO Neo Series EC and CW Controllers

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

CVE-2025-32432

🔐 CVE-2025-32432 — Craft CMS 预认证 RCE Craft CMS 中的预认证远程代码执行 发现与开发 byMohammed Idrees Banyamer 📌 概述 CVE-2025-32432 是一个严重的预认证远程代码执行（RCE）漏洞，影响 Craft CMS 的多个版本。通过将未清理的会话数据存储与不安全的反序列化小工具链接起来，未经身份验证的攻击者可以在远程服务器上执行任意命令。 🎯 受影响版本 分支| 受影响范围 ---|--- Craft CMS 3.x| ≤ 3.9.14 Craft CMS 4.x| ≤ 4.14.14 Craft CMS...

CVE-2026-7174: Improper Neutralization of Input During Web Page Generation

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...

CVE-2026-7173: Improper Neutralization of Input During Web Page Generation

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events/ /editgeneral during...

CVE-2026-71483

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-100177

The AIL Framework crawler task creation API apiaddcrawlertask contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared...