CVE-2023-49339

Relatório de Vulnerabilidade de Segurança CVE-2023-49339: Sistema Banner da Ellucian Introdução Este documento descreve uma vulnerabilidade de segurança crítica encontrada no Sistema Banner da Ellucian, particularmente na versão 9.17 e versões anteriores. A vulnerabilidade foi identificada em...

CVE-2018-12018

CVE-2018-12018 Mitre https://vulners.com/cve/CVE-2018-12018 Go Ethereum geth 1.8.11 से पहले के LES प्रोटोकॉल कार्यान्वयन में GetBlockHeadersMsg हैंडलर, ऐरे इंडेक्स के लिए पूर्णांक साइननेस त्रुटि के कारण एक्सेस उल्लंघन का कारण बन सकता है, जो हमलावरों को -1 के query.Skip मान वाला पैकेट भेजकर डिनायल...

CVE-2025-6713

CVE-2025-6713 Erstelle eine Aggregations-Pipeline, um ohne ordnungsgemäße Autorisierung auf Daten zuzugreifen, aufgrund unsachgemäßer Handhabung von $mergeCursors in MongoDB v8.0 v7.0 v6.0 6.0.22 Installation nicht sehr schwierig – verwende einfach pip3, um die Abhängigkeiten zu installieren: pip...

HTB-Pterodactyl-Writeup

Отчет о тесте на проникновение — HackTheBox: Pterodactyl Дата: 8 апреля 2026 г. Цель: Pterodactyl HackTheBox Сложность: Средняя ОС: Linux openSUSE Leap 15.6 Тестер: V0idW1re Краткое описание Машина Pterodactyl на HackTheBox представила реалистичный сценарий атаки, включающий неправильно...

CVE-2017-1000112-PoC

CVE-2017-1000112Overflow del buffer scarica l'immagine iso da https://old-releases.ubuntu.com/releases/16.10/ubuntu-16.10-server-amd64.iso gcc exploit.c -o exploit ottenuto root...

CVE-2023-32749-PoC

CVE-2023-32749 | Atribuição de Função Não Autorizada no Pydio Cells Exploit para CVE-2023-32749 que afeta Pydio Cells 4.1.2 e anteriores. Um usuário autenticado com privilégios baixos pode criar um novo usuário externo com todas as funções atribuídas, concedendo acesso a todas as células e espaço...

CVE-2025-62878

CVE-2025-62878: Path Traversal del Local Path Provisioner Panoramica Elemento| Valore ---|--- ID CVE| CVE-2025-62878 ID GHSA| GHSA-jr3w-9vfr-c746 Gravità| Critico CVSS 10.0 CWE| CWE-23 Relative Path Traversal Componente interessato| rancher/local-path-provisioner Versioni interessate| v0.0.27...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Flowise Passwort-Reset Account-Übernahme ATO Nur für Forschungs- und Testzwecke! Ich übernehme keine Haftung für Schäden an Live-Infrastrukturen, wenn dieses Tool nicht bestimmungsgemäß verwendet wird. Verwenden Sie es nur auf Systemen, die Ihnen gehören oder für die Sie eine Testberechtigung...

CVE-2025-66678

CVE-2025-66678 In Hardware Read & Write Utility v1.25.11.26, il driver esponeva lettura e scrittura arbitrarie dei registri MSR, oltre a lettura e scrittura della memoria fisica tramite MmMapIoSpace, entrambe le quali consentono l'esecuzione di codice nel kernel. Dettagli del PoC Il PoC sostituir...

EUVD-2026-66815

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

EUVD-2026-66804

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

EUVD-2026-66803

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

EUVD-2026-66760

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account...

EUVD-2026-66764

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

EUVD-2026-66763

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

PT-2026-82736

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

PT-2026-82780

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 version FW-9167-0-11 Ebyte NA111-M affected versions not specified Description The web management interface fails to consistently enforce authentication before granting access to administrative functionality. This allows an...

PT-2026-82789

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

PT-2026-82450

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.11.0 through 3.17.0 Description An LDAP Injection occurs due to improper neutralization of special elements used in an LDAP query. This allows a caller with valid credentials for one LDAP directory entry to authenticat...