149 matches found
PrecIR
PrecIR Collection of software and hardware tools, their source code and design files for communicating with infrared based Electronic Shelf Labels. See http://furrtek.free.fr/index.php?a=esl for reverse-engineering of the system, the protocol and electronics. Thanks to @david4599 for infos about...
ChromeSHELFLoader
Chrome SHELF Loader An exploit for CVE-2020-6418 implementing a SHELF Loader. Published as part of Tmp.0ut volume 2...
The_Shelf
The Shelf The Shelf is a place where Trustedsec places capabilities that are being retired from our standard usage. Capabilities uploaded to the shelf are unsupported and AS IS. This repo will not accept pull requests either and they will be closed without comment. Layout You will see the folders...
Prompt-Shelf
Prompt Shelf This technical prototype of a Windows-focused gr...
Prompt-Shelf
Prompt Shelf This technical prototype of a Windows-focused gr...
CVE-2026-108691
mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to...
PT-2026-109985
mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to...
CLEANSTART-2024-ZE33362 Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101
Security vulnerability affects the chromium package. Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101...
CVE-2026-54166
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...
CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...
CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...
EUVD-2026-76766
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...
CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...
CVE-2026-54166
Shelf , a physical asset tracking platform, contains a Server-Side Request Forgery (SSRF) in its Asset CSV Content Import feature prior to version 1.20.3 . Authenticated users with the asset:import permission can bypass imageUrl validation using image-extension suffixes, path keywords, domain sub...
CVE-2026-54166: Server-Side Request Forgery (SSRF)
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...
PT-2026-90506
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...
CVE-2026-47697
Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...
CVE-2026-47697
Shelf is a multi-tenant platform for tracking physical assets. Prior to version 1.20.2, several endpoints accepted entity IDs from input and connected/read/updated them without verifying ownership, enabling cross-tenant IDOR where an authenticated user in Org A could access Org B’s data (assets, ...
CVE-2026-47697
Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and "connect"-ed / read / updated them without verifying the IDs belonged to the caller's...
CVE-2026-47697 Shelf has cross-organization IDOR: authenticated users could read/attach another workspace's assets, tags, custodians, bookings, QR codes and audit data
Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...