285 matches found
CVE-2022-37201
CVE-2022-37201 CVE-2022-37201 POC POC First of all you should install sqlmap you need set target domain or IP your cookie the run the shell sqlmap -u http://targetDomainOrIP/jfinalcms/jfinalcms/admin/contact/list --thread 8 --batch --smart --random-agent --data "...
pharmacy-sqli-CVE-2026-7392
Pharmacy Sales and Inventory System 1.0 - CVE-2026-7392 SQL Injection SourceCodester Pharmacy Sales and Inventory System V1.0 pure PHP/MySQL version CVE : CVE-2026-7392 Endpoint : /ajax.php?action=deletesupplier id parameter Type : SQL Injection CWE-89 CVSS 3.1 : 6.3 Medium Author : oretnom23...
CVE-2024-44541
CVE-2024-44541: SQL Injection Vulnerability in Inventio Lite v4 Description Inventio Lite v4 is vulnerable to SQL Injection SQLi in the /action=processlogin endpoint. This vulnerability allows attackers to inject arbitrary SQL queries via the username parameter in POST requests, potentially leadi...
discuz-ml-rce
discuz-ml-rce Sistemas afectados y versiones: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Causa de la vulnerabilidad: el sistema Discuz!ML no filtra el contenido del parámetro language recibido mediante 'l' en la cookie, lo que provoca concatenación de cadenas y la ejecución de código PHP. En el campo d...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
CLEANSTART-2026-TC21251 ParseAddress function constructs domain-literal address components through repeated string concatenation
Security vulnerability affects the cri-tools package. The ParseAddress function constructs domain-literal address components through repeated string concatenation...
AlmaLinux 9.2 [TuxCare] Security Update: butane / butane-redistributable (ALMALINUX9.2:CLSA-2026:1772646645)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1772646645 advisory. - Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out...
AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1770112258)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1770112258 advisory. - Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out...
Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1769786327)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769786327 advisory. - Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out...
CLEANSTART-2026-AY14774 ParseAddress function constructs domain-literal address components through repeated string concatenation
Security vulnerability affects the buildkitd package. The ParseAddress function constructs domain-literal address components through repeated string concatenation...
CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
Rocky Linux 9.6 [TuxCare] Security Update: butane / butane-redistributable (ALMALINUX9.6:CLSA-2026:1772573053)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772573053 advisory. - Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out...
PT-2026-103126
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS-STREAM8:CLSA-2026:1772120065)
The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1772120065 advisory. - The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
Summary The XSS blueprint validator Security::detectXss runs on the raw page content before Twig processing. An attacker can use Twig's string concatenation operator to dynamically construct an event handler name at render time. The validator sees "on" "error" - a harmless Twig expression - and...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
PT-2026-94131
Summary The XSS blueprint validator Security::detectXss runs on the raw page content before Twig processing. An attacker can use Twig's string concatenation operator to dynamically construct an event handler name at render time. The validator sees "on" "error" - a harmless Twig expression - and...