Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the GET /api/station/id/vue/profile endpoint. An attacker can obtain sensitive credentials, including admin, source, and relay passwords, by making authenticated requests with only View Station Page permission...

D-Link D-View 8 v2.0.1.28 - Authentication Bypass

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 id: CVE-2023-5074 info: name: D-Link D-View 8 v2.0.1.28 - Authentication Bypass author: DhiyaneshDK severity: critical description: | Use of a static key t...

CVE-2026-100854

AzuraCast versions before 0.23.6 are vulnerable to a metadata injection flaw via the Liquidsoap API . The root cause is the missing RequireInternalConnection middleware on the API endpoint and the incorrect derivation of the AutoDJ flag from header presence instead of a validated value. An attack...

CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

CVE-2024-45058

CVE-2024-45058 PoC para CVE-2024-45058 Control de Acceso Roto, que permite a cualquier usuario con permiso de visualización en la sección de configuración de usuario convertirse en administrador cambiando su propio tipo de usuario. Toma el ID de nivelusuario deseado y ejecuta el exploit. Uso usag...

CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

EUVD-2026-87767

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...

CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability

PoC de Vulnerabilidad de Ejecución Remota de Código en Microsoft Outlook Este script presenta una prueba de concepto PoC para CVE-2024-21413, una falla de seguridad crítica identificada en Microsoft Outlook con una puntuación CVSS de 9.8. Denominado exploit MonikerLink, esta vulnerabilidad conlle...

cve-2026-21509-office_security_bypass_reproduction

CVE-2026-21509 — Omisión de la función de seguridad de Microsoft Office CVE-2026-21509 es una vulnerabilidad de omisión de la función de seguridad de Microsoft Office CVSS 7.8 , explotada activamente por APT28 hackers rusos contra Ucrania Dependencia de entradas no confiables en decisiones de...

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45507 info: name: Apache OFBiz -...

Moniker-Link-CVE-2024-21413

🛡️ Moniker Link CVE-2024-21413 Sala: Moniker Link CVE-2024-21413 — TryHackMe Estado: ✅ Completado Fecha: 30 de mayo de 2025 🎯 Objetivo Entender y explotar CVE-2024-21413, una vulnerabilidad en Microsoft Outlook que evita la Vista Protegida usando Moniker Links para filtrar credenciales NTLM...

CVE-2026-71483

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-71483

The Horilla HR and CRM software (prior to version 1.6.0 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the lack of HTML neutralization when the search parameter at /employee/employee-filter-view is reflected by jQuery's .html() function in employee/templates/emp...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2026-88421

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...