CVE-2022-41445

CVE-2022-41445 Cross Site Scripting in Teacher's Record Management System using CodeIgnitor Suggested description A cross-site scripting XSS vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int...

BadOutlook

Bad Outlook A simple PoC which leverages the Outlook Application Interface COM Interface to execute shellcode on a system based on a specific trigger subject line. By utilizing the Microsoft.Office.Interop.Outlook namespace, developers can represent the entire Outlook Application or at least...

CVE-2025-43920

CVE-2025-43920: Command Injection via Email Subject in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43920 Severity: 5.4 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Type: Remote Affected Software:...

CVE-2026-84790

A flaw was found in OpenVPN. This vulnerability allows a remote authenticated attacker to impersonate other users by submitting a specially crafted certificate subject field during authentication. By assuming the identity of a different user, an attacker can gain unauthorized access to restricted...

EUVD-2026-100750

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

DEBIAN-CVE-2026-84790

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

CVE-2026-84790

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

CVE-2026-84790

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

CVE-2026-84790

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

CVE-2026-84790

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

CVE-2026-84790

OpenVPN 2.7alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

CVE-2026-84790

Versions OpenVPN 2.7_alpha1 through 2.7.7 are vulnerable to a security flaw that allows remote authenticated users to impersonate others . This vulnerability is triggered by providing a crafted certificate subject field . The issue is associated with CWE-290 (Authentication Bypass by Spoofing) an...

CVE-2022-25813

CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz By inserting malicious content in a message’s “Subject” field, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote...

CVE-2026-54390

CVE-2026-54390 — JTL Shop Smarty SSTI Mass Exploit Pre-Auth Contact Form → Email Subject → fetch'string:' → RCE Overview CVE-2026-54390 is a critical CVSS 9.8 unauthenticated Server-Side Template Injection in JTL Shop 5.2.0–5.7.1. The SmartyRenderer::renderTemplate method passes email subject lin...

PT-2026-113540

OpenVPN 2.7 alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field...

gitlab-cve-2020-10977

GitLab CVE2020-10977 Introduction This script provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. The CVE is an arbitrary file read which allows you to extract the Rails secretkeybase by downloading the GitLab secrets.yaml file. Which in turn, enables you...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - Stored XSS, HTML Injection & CSS Injection in Roundcube Webmail Overview This repository contains a Proof-of-Concept PoC for CVE-2026-48849 , a Stored Cross-Site Scripting XSS, HTML Injection, and CSS Injection vulnerability in Roundcube Webmail. The vulnerability allows...

CVE-2023-49970

CVE-2023-49970 Customer Support System 1.0 - SQL Injection Vulnerability in the "subject" Parameter During "saveticket" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

getaltname

GSAN - Obtener Nombres Alternativos del Sujeto GSAN es una herramienta que puede extraer Nombres Alternativos del Sujeto SAN encontrados en Certificados SSL directamente desde servidores https, lo que puede proporcionarte nombres DNS subdominios o servidores virtuales. No depende de los registros...

CVE-2026-105247

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/Subject/btnfunctions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The...