22158 matches found
CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a patch. To apply the...
SUSE CVE-2026-24733
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a specification inval...
CVE-2026-22860
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../rootexample/ can escape the configured root if the target path starts with the root string, allowing directory...
CVE-2025-70151
code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints updateprofilepicture.php and uploadpicture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied...
Exploit for Path Traversal in Repetier-Server
Repetier-Server |HTTP request with ..%5c traversal| BRepetier...
PT-2026-20478
Name of the Vulnerable Software and Affected Versions code-projects Scholars Tracking System version 1.0 Description An authenticated attacker can achieve remote code execution through unrestricted file upload. The update profile picture.php and upload picture.php endpoints store uploaded files i...
CVE-2026-22860: Improper Limitation of a Pathname to a Restricted Directory
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../rootexample/ can escape the configured root if the target path starts with the root string, allowing directory...
CVE-2025-70151
code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints updateprofilepicture.php and uploadpicture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied...
The vulnerability of the SCADA system’s web server FAST/TOOLS allows a perpetrator to carry out an MITM attack.
The vulnerability of the FAST/TOOLS SCADA system’s web server is related to improper security checks for standard elements. Exploiting this vulnerability could allow a malicious actor to carry out an MITM attack...
The vulnerability of the SCADA system’s web server FAST/TOOLS allows a intruder to disclose protected information.
The vulnerability of the FAST/TOOLS SCADA system’s web server is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...
The vulnerability of the SCADA system’s web server FAST/TOOLS allows a intruder to disclose protected information.
The vulnerability of the FAST/TOOLS SCADA system’s web server is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...
Vulnerability in Cosminexus HTTP Server
Overview Vulnerability has been found in Cosminexus HTTP Server. CVE-2025-23048 This vulnerability does not apply if SSL is disabled. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official...
Vulnerability in Cosminexus HTTP Server and Hitachi Web Server
Overview Vulnerability has been found in Cosminexus HTTP Server and Hitachi Web Server. CVE-2024-43204 Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take...
📄 Pterodactyl Panel Remote Code Execution
This Metasploit module exploits a remote code execution vulnerability in Pterodactyl Panel versions before 1.11.11. The vulnerability allows an attacker to write a malicious PHP file via the locale functionality and then execute it to gain a reverse shell...
The vulnerability of the SCADA system’s web server, Yokogawa FAST/TOOLS, allows a hacker to bypass existing security restrictions.
The vulnerability of the SCADA system’s web server, Yokogawa FAST/TOOLS, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers to circumvent existing security restrictions remotely...
The vulnerability of the SCADA system’s web server, Yokogawa FAST/TOOLS, allows a intruder to execute arbitrary code.
The vulnerability of the Yokogawa FAST/TOOLS SCADA system’s web server is related to improper security checks for standard elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the OPTIONS method from a remote location...
Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.0 security release
Red Hat JBoss Web Server 6.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...
Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.0 security release
Red Hat JBoss Web Server 6.2.0 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Linux Enterprise 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CV...
