1401 matches found
CVE-2015-3246
CVE-2015-3246 and More cve-2015-3245, cve-2015-3246, cve-2015-3245, cve-2015-3246 Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក...
CVE-2026-104694
The Thrive Automator WordPress plugin, in versions prior to 11.2 , is vulnerable to blind SQL injection . The flaw exists because the plugin fails to properly sanitize and escape an array key within a parameter before incorporating it into a SQL query. This allows authenticated attackers with edi...
CVE-2026-104694 Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks...
BIND-9-Cache-Poisoning-PoC---CVE-2025-40778
BIND 9 Cache Poisoning PoC - CVE-2025-40778 Conceptual Overview This vulnerability allows an attacker to corrupt the DNS cache of a BIND Resolver, forcing legitimate users to be redirected to malicious IP addresses without their knowledge. The core logic of the attack: The attack relies on...
reflector
reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...
CSZ-CMS-Stored-XSS---Site-Settings
CSZ CMS Stored XSS v1.3.0 Author: Sergio Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Site Settings Menu. Attack Vectors: Scripting A vulnerability in the...
CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content
CSZ CMS Stored XSS v1.3.0 Author: Sergio CVE: 2023-41436 Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component. Attack Vectors:...
CVE-2025-13833
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish...
CVE-2025-13833
A vulnerability exists in SecureConnector for Windows involving insecure TLS fingerprint validation . When the "Additional Appliance Connections" setting is enabled and the configuration file contains more than three trusted-server entries, the agent may accept sessions with malicious servers if ...
EUVD-2025-211200
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish...
CVE-2025-13833 Insecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code Execution
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish...
CVE-2026-114486
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...
CVE-2026-114486
An incorrect authorization vulnerability exists in the Devolutions Gateway token generation within Devolutions Server 2026.3.10.0 and earlier. This flaw allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway. By utilizing wildcard additional de...
CVE-2026-114486
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...
EUVD-2026-108218
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...
PT-2026-117620
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.98 Parse Server versions 9.0.0 through 9.10.3-alpha.1 Description Insufficient enforcement of class-level permissions for the Session class occurs during session creation. An authenticated user or an entity...
CVE-2026-110219 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...
CVE-2026-110219
QloApps versions through 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the Additional Facilities back-office form, where the price parameter fails to properly sanitize input. An attacker can craft a request containing an unescaped price value tha...
CVE-2026-110219: Improper Neutralization of Input During Web Page Generation
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...