CVE-2026-63278

A flaw was found in LibreOffice. A remote attacker could craft a malicious document containing specially constructed URLs. When a user opens this document, these URLs could expand environment variables or INI file values, leading to the exfiltration of potentially sensitive information to a remot...

swagger-ui

引言：Swagger UI 的作用 Swagger UI 是一个广泛使用的库，它能将 OpenAPI（原 Swagger）规范渲染为交互式 Web 界面。开发者与集成人员无需后端实现即可探索和测试 API。 CVE‑2018‑25031 详情 根本原因：远程规范加载 该漏洞源于 Swagger UI 客户端对用于加载远程配置或规范文件的 URL 查询参数验证不足。涉及的常见参数包括： ?url=.yaml ?configUrl=.json 攻击者可将这些参数指向一个攻击者控制的、远程托管的 OpenAPI 定义或配置文件，该文件可能被易受攻击的实例渲染。 潜在攻击向量...

CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

CVE-2026-84168

The Easy Hide Login WordPress plugin, in versions prior to 1.7 , fails to fully enforce its hidden-login protection. This flaw allows an unauthenticated attacker to bypass the security measures by using specific password-reset request parameters to access the standard login page. Furthermore, the...

EUVD-2026-85034

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84046 Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84046

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to validate user-supplied URLs before fetching them server-side, specifically via the Avatar URL f...

CVE-2025-63571

Descripción Durante el análisis del sistema de IA ChatGPT GPT-5, se descubrió una vulnerabilidad de Server-Side Request Forgery SSRF. Este problema ocurre porque la aplicación obtiene y ejecuta automáticamente URLs externas enviadas por los usuarios por ejemplo, webhooks sin ninguna validación o...

log4j-urlscanner

log4j-detect Script simple en Python 3 para detectar la vulnerabilidad de la biblioteca Java "Log4j" CVE-2021-44228 en una lista de URL con multihilo El script "log4j-detect.py" desarrollado en Python 3 se encarga de detectar si una lista de URLs son vulnerables a CVE-2021-44228. Para ello, envía...

cve-2023-2745

如何使用 Сохраните файл как checkcve-2023-2745.py и дайте право на запуск: chmod +x checkcve-2023-2745.py Установите зависимость один раз: python3 -m pip install requests Запуск: python3 checkcve-2023-2745.py https://example.com...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Important: Red Hat Security Advisory: runc security update

An update for runc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2024-21413-Outlook-Assessment

title: "CVE-2024-21413 Enlace Moniker: Evaluación de ejecución remota de código en Microsoft Outlook" date: 2026-06-28 author: Lindon Mitchell YoguiCR role: Investigador de Seguridad / Analista de Exploits status: Completado classification: Público / Portafolio environment: TryHackMe - Laboratori...

CVE-2025-11833-PoC

Comprobador de CVE-2025-11833 python3 main.py --url http://localhost --username admin --loot Este repositorio es solo para fines educativos y de investigación. El autor no asume ninguna responsabilidad por el uso indebido. Siempre prueba los PoCs en un entorno controlado y aislado...

CVE-2024-27564

CVE-2024-27564 Description: A vulnerability in pictureproxy.php allows remote attackers to perform arbitrary requests by injecting URLs into the url parameter. This SSRF vulnerability can be exploited without authentication, making it particularly dangerous. The vulnerable code is in the...

POC_CVE-2025-53558

CVE-2025-53558 Disclaimer This program should only be used for authorized security testing and research purposes. Users must comply with the Cybersecurity Law and use it appropriately. The author is not responsible for any illegal attacks or other unlawful acts that occur when users use this tool...

CVE-2020-12696

CVE-2020-12696 ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ Iframe iframe src="javascript:confirmdocument.cookie" width="100%" height="500" Version plugin: 4.4 Tested on: WordPress 5.2.4 Researche...

AlmaLinux 9 : runc (ALSA-2026:70191)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:70191 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding description blo...

ALSA-2026:70641 Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...