270793 matches found
CVE-2026-94003 Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function getcsspathfromuri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been...
miasma v0.4.3
🌀 Miasma AI companies continually scrape the internet at an enormous scale, swallowing up all of its contents to use as training data for their next models. If you have a public website, they are already stealing your work. Miasma is here to help you fight back! Spin up the server and point any...
FMD Android v0.17.0
FMD Android Find your device via SMS, instant messengers, or a web interface FMD Server. FMD allows you to locate, ring, wipe and issue other commands to your device when it's lost. It aims to be a secure open source alternative to Google's Find My Device. Why? I lost my brand new phone last week...
wingdata
Wingdata — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン VHost 列挙で WingFTP サーバーを発見。CVE-2025-47812 のコマンドインジェクションで初期アクセスを取得。root 権限は、細工された tar アーカイブを展開する sudo Python リストアスクリプトを経由して取得 — tar のパストラバーサルにより root として任意のファイルを書き込む。 列挙 root@kitploit: nmap -sC -sV wingdata.htb -Pn 22/tcp open ss...
CVE-2026-94003: Stack-based Buffer Overflow
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function getcsspathfromuri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been...
PT-2026-95908
Name of the Vulnerable Software and Affected Versions Dromara UJCMS versions prior to 12.3.2 Description An improper authorization issue exists in the UserController component. A remote attacker can manipulate the Username variable within the usernameExist function of the...
CVE-2026-15463
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
CVE-2026-11608 WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
Open Web Analytics 1.7.3 - Remote Code Execution
Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...
CVE-2026-86591: Missing Authorization
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...
PT-2026-95748
Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application...
PT-2026-95900
Name of the Vulnerable Software and Affected Versions Comfast CF-N1-S version 2.6.0.1 Description The Web Management Interface contains a stack-based buffer overflow that can be triggered remotely. The issue exists within the get css path from uri function located in the /cgi-bin/mbox-config...
CVE-2026-84106
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...
CVE-2026-84108
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation...
CVE-2026-84031
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...
CVE-2026-84070
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...
CVE-2026-84074
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...
