CVE-2026-21962

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server Proxy Plug-in Access-Control Bypass via URI Normalization Inconsistency An independently reproduced exploit and analysis for CVE-2026-21962 improper access control, CVSS 10.0 in Oracle HTTP Server / the Oracle WebLogic Server Proxy Plug-in for...

CVE-2025-63588

CVE-2025-63588 Reflected Cross-Site Scripting XSS in CMSimpleXH cmsimplexh path handling Estimated CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medium Assigned CVE: CVE-2025-63588 Products: CMSimpleXH - 1.8 Vendor: CMSimpleXH - https://www.cmsimple-xh.org/ Summary A reflected Cross-Site...

CVE-2022-22274_CVE-2023-0656

SonicWall NGFW CVE-2022-22274 & CVE-2023-0656 On March 24, 2022, SonicWall released an advisory with the following details: A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service DoS or potentially results in...

svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

k8s-CVE-2021-43557-poc

Installation install minikube install apisix: helm repo add apisix https://charts.apiseven.com helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update kubectl create ns ingress-apisix helm install apisix apisix/apisix \ --set gateway.type=NodePort \ --set...

cve-2025-59489

Unity CVE-2025-59489 Vulnerability Detection Tool An automated detection tool for Unity Runtime injection vulnerabilities, specifically designed for Android game platforms. Vulnerability Overview CVE ID : CVE-2025-59489 CVSS Score : 8.4 High Affected Scope : Android applications built with Unity...

CVE-2023-23924

CVE-2023-23924 Dompdf vulnerable to URI validation failure on SVG parsing · CVE-2023-23924 · GitHub Advisory Database https://github.com/advisories/GHSA-3cw5-7cxw-v5qg Run Terminal 1 ❯ cd www ❯ php -S 127.0.0.1:9000 -t . Terminal 2 ❯ cd src ❯ php cve202323924.php Check Check the "whoami" command ...

GHSA-374F-7CHJ-9948 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

Summary sanitize-html 2.17.7 introduced animatesUrlAttribute to block SVG animation elements animate, animateColor, animateMotion, animateTransform, set when their attributeName targets a URL sink like href. However, this check is bypassed when the animation element uses a namespace prefix e.g.,...

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

Summary sanitize-html 2.17.7 introduced animatesUrlAttribute to block SVG animation elements animate, animateColor, animateMotion, animateTransform, set when their attributeName targets a URL sink like href. However, this check is bypassed when the animation element uses a namespace prefix e.g.,...

NPM: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

NPM: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection XSS vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.17.7, 2.18.0...

CVE-2026-113657

The sanitize-html library (versions 2.17.7 through 2.18.0 ) used by ApostropheCMS contains a vulnerability where an application configuration permitting namespace-prefixed SVG animation elements can bypass SMIL URL protection . Because prefixed tag names do not match the unprefixed animation-elem...

CVE-2026-113657 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting...

CVE-2026-113657 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting...

CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina Info : New Microsoft Office zero-day used in attacks to execute PowerShell Summary On the 29th of May 2022, the NaoSec team, an independent Cyber Security Research Team, discovered a malicious Office document shared on Virustotal. This...

halo-2.25.4-CVE-2026-67919

Authenticated Remote Code Execution RCE via Unvalidated Plugin URI Installation in Halo 2.25.4 1. Vulnerability Summary A critical security vulnerability has been identified in Halo version 2.25.4. The application provides an administrative endpoint to install or upgrade plugins from a remote URI...

RLSA-2026:84587 Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

perl-URI security update

An update is available for perl-URI. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This module implements the URI class. Objects of this class represent...

RLSA-2026:84588 Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...