CVE-2026-112164

The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext...

CVE-2026-112164

The LaserGest mobile application contains a security flaw where assistance portal credentials are encrypted using a hardcoded AES key and IV . An attacker who gains access to the application package can exploit this root cause to recover the credentials in cleartext . No specific patch version or...

EUVD-2026-120088

The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext...

CRM Platform SQL Injection

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

Elph Mobile Data Compromise

The vulnerability in the Elph Mobile unified communications platform is related to improper export of application components. Exploitation of this vulnerability may allow an attacker to compromise the integrity of protected information...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

HvLoader

HvLoader Overview HvLoader.efi is an EFI application for loading an external hypervisor loader. HvLoader.efi loads a given hypervisor loader binary DLL, EFI, etc., and calls it's entry point passing HvLoader.efi ImageHandle. This way the hypervisor loader binary has access to HvLoader.efi's comma...

kirjuri

Kirjuri has been deprecated. I have started a new project that covers most of the use cases that Kirjuri handles and a lot more. Check out the DFIRe case management application for all your case and evidence management needs. SECURITY UPDATE 7.5.2021 As this project has been inactive for years, i...

CVE-2026-118798

Sensitive authentication data, including credentials , OAuth-related secrets , session information , and authentication artifacts , are exposed through application logs and persistent client-side storage . This exposure can lead to unauthorized access and session compromise . While the specific s...

CVE-2026-118798

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise...

CVE-2026-118458

The software contains a vulnerability where the shared AIS login routing incorrectly selects a production-shipped test DAO . This results in a plaintext comparison for the H and V application codes, which allows for the acceptance of fixed administrator accounts . While the vulnerability was sigh...

EUVD-2026-120033

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise...

EUVD-2026-120020

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts...

CVE-2026-123770

Apache Axis2/Java (versions through 2.0.1 ) is vulnerable to an Allocation of Resources Without Limits or Throttling issue. The multipart/form-data and application/x-www-form-urlencoded message builders read request bodies directly from the transport stream without size limits, bypassing servlet ...

EUVD-2026-119934

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not...

chatter

april 9, 2023 abandonware - sorry - busy elsewhere. will recode from scratch in a xplatform language in exchange for tons of money. october 6, 2021 this may soon no longer be abandonware. as for now it is very unstable. i'd like to recode it from scratch. description chatter is a proof of concept...

CVE-2026-124574

The chenyme grok2api software, version 3.1.6 and below , contains a vulnerability in the Video Job Retry Handler component. Specifically, the beginSelectionSession function in backend/internal/application/gateway/video.go is susceptible to improper authorization , which could allow for remote att...

EUVD-2026-119862

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to...

PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...

Rukovoditel <= 2.7.2 - Cross Site Scripting

A stored cross site scripting XSS vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter. id: CVE-2020-35984 info: name: Rukovoditel = 2.7.2 - Cross Site...