CVE-2026-81677

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81676

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81672

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...

CVE-2026-81674

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

CVE-2026-40526

Volmarg Personal Management System contains a path traversal vulnerability in the GET /public/get-file/{path} endpoint. The path parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, allowing an authenticated attacker to read arbitrary fi...

EUVD-2026-67124

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...

CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...

CVE-2023-50071

CVE-2023-50071 Customer Support System 1.0 - ثغرات حقن SQL متعددة - savedepartment الوصف : تسمح ثغرات حقن SQL المتعددة في /customersupport/ajax.php?action=savedepartment في Customer Support System 1.0 للمهاجمين المصادق عليهم بتنفيذ أوامر SQL اعتباطية عبر id أو name. الإصدار المعرض للثغرة : Custom...

CVE-2020-25627

CVE-2020-25627 XSS مخزّن عبر وسيط moodlenetprofile في ملف تعريف المستخدم إثبات المفهوم الخاص بي حول هذا CVE متطلبات المستخدم: طالب أو الموقع للتسجيل XSS في moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through creating a new user without assigning roles...

CVE-2022-45988

CVE-2022-45988 StarSoftComm HP CooCare توجد ثغرة تصعيد صلاحيات لقد تواصلت مع hp-security-alert وقد أصلحوا هذا الخطأ. بخصوص StarSoftComm CooCare HP-PSRT-IR 4106 استجاب البائع بالمعلومات التالية: اتبع هذه الخطوات للتحديث: 1. تشغيل eService 2. انتظر حوالي 3 دقائق 3. أغلق eService وقم بتشغيله مرة أخر...

opensshenum

Description : Opensshenum est un énumérateur d'utilisateurs OpenSsh permettant de vérifier une liste arbitraire de noms d'utilisateurs auprès d'un serveur OpenSsh, afin de connaître ceux réellement présents sur cette machine distante. Ce programme exploite un bug corrigé en juillet 2018 dont...

CVE-2019-15511

Exploit GOG Galaxy pour CVE-2019-15511 root@kitploit: usage: exploit.py -h --action LaunchElevatedRequest,FixDirectoryPrivilegesRequest,CreateDirectoryRequest,QueryProcessInfoRequest,InstallServiceRequest,DeleteServiceRequest,MoveAndVerifyGlobalDependencyRequest target positional arguments: targe...

Fake Apple Pay charge brings the classic tech support scam to your phone

iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users. Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones. Instead of a...

CVE-2026-76232

A flaw was found in Renovate. This command injection vulnerability exists in the helmv3 manager due to improper sanitization of the repository parameter when appended to helm registry login commands. An attacker with write access to a repository can exploit this by crafting malicious Chart.yaml...

CVE-2026-81677

TOOOLS' iSquad is affected by a SQL injection vulnerability in the /ws/apiprensa/getVideo endpoint, caused by improper validation of the GET parameter id_ambito. User input is incorporated directly into MariaDB queries without sanitization or prepared statements, allowing an attacker to inject SQ...

EUVD-2026-67013

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81677 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81677 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

EUVD-2026-67012

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81676 Multiple Vulnerabilities in TOOOLS' iSquad

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...