wp2shell

wp2shell Injection SQL aveugle par confusion de route du batch REST WordPress — chaîne d'exploitation automatisée. CVE-2026-63030 / CVE-2026-60137 | ---|--- Versions concernées| WordPress 6.9.0 – 6.9.4 et 7.0.0 – 7.0.1 Correctif| WordPress 6.9.5 / 7.0.2 Sink| SQL authornotin via paramètre...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 برهان ثغرة حقن SQL في Content API لنظام Ghost CMS من TryGhost ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c نظرة عامة CVE-2026-26980 هي ثغرة حقن SQL غير مصادق عليها في Content API لنظام TryGhost Ghost CMS. يمكن الوصول إلى المسار...

CVE-2026-25089

CVE-2026-25089 - Brouillon - Fortinet FortiSandbox ⚡ Utilisation simple Utilisez ce projet uniquement dans des environnements sûrs et autorisés, tels que : Machines virtuelles locales Conteneurs Docker Configurations de laboratoire isolées Environnements de test d'intrusion autorisés Exemple de...

CVE-2023-35078

CVE-2023-35078 استعلامات Shodan يمكنك استخدام استعلامات Shodan التالية للعثور على الأهداف العامة. http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs يمكنك استخدام ما يلي لتحويل البيانات من واجهة Shodan API إلى صيغة مناسبة لسكريبت الفحص: jq -cr 'select.http.favicon.hash == 36209131...

CLEANSTART-2026-ON00136 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-KW24127 flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www

Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www...

burp-extensions-montoya-api-examples

Exemples d'extensions Extension| Description ---|--- Hello World| Affiche une sortie à divers emplacements dans Burp HTTP Handlers| Démontre l'exécution de diverses actions sur les requêtes passant par n'importe quel outil de Burp Proxy Handlers| Démontre l'exécution de diverses actions sur les...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105742

A flaw was found in docling. This vulnerability can lead to information disclosure of sensitive credentials, such as API keys and session tokens. When remote image fetching is enabled, the HTML image loader fails to restrict custom request headers to the document's original domain. A remote...

CVE-2026-105758

A flaw was found in vllm. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with excessively high video processing parameters to affected API endpoints. Because the backend does not enforce upper bounds on user-controlled video frame counts and rates, the...

CVE-2026-105756

A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...

PT-2026-106768

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-mcp versions 3.61.0 through 3.87.0 Description An authenticated user can manage MCP API keys outside the intended account, which allows for privilege escalation through account takeover. Recommendations Update...

PT-2026-106755

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group documents/upload stores an attacker-controlled group document filename that group workspaces.html later interpolates into inline Share even...

PT-2026-107207

An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role...

PT-2026-106564

In the Linux kernel, the following vulnerability has been resolved: net/sched: act api: release tail references on DELACTION failure A batched RTM DELACTION request takes a temporary reference on each action before attempting any deletion. tcf action delete clears each processed slot and drops it...

PT-2026-107290

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/push mirrors checked only whether mirroring was enabled and not the mirror DISABLE NEW PUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where...

PT-2026-107294

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachment id also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

PT-2026-107111

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

PT-2026-106754

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

PT-2026-106806

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...