104030 matches found
CVE-2019-25347 thesystem App 1.0 - 'username' SQL Injection
thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like ' or '1=1 to the username field to gain unauthorized access to user accounts...
Hand over the keys for Shannon’s shenanigans
Welcome to this week's edition of the Threat Source newsletter. Last week, yet another security AI tool made the rounds on social media: Shannon, a fully autonomous AI penetration testing tool created by Keygraph. It "autonomously hunts for attack vectors in your code, then uses its built-in...
CVE-2026-21434 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule
webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WTCLOSESESSION capsule containing an excessively large Application Error Message. The implementation...
CVE-2026-21434
This CVE affects webtransport-go (versions 0.3.0 to 0.9.0). A WT_CLOSE_SESSION capsule with an oversized Application Error Message can be fully read and stored in memory due to lack of the draft-mandated 1024-byte limit, enabling memory exhaustion. The issue is fixed in version 0.10.0. Affected i...
SUSE-SU-2026:0483-1 Security update for zabbix
This update for zabbix fixes the following issues: - CVE-2024-36469: Introduced clamping for mitigation of timing attacks. bsc1240676 - CVE-2024-42325: Restricted access to user fields using user.get API method for users of User and Admin type, and restricted access to alert entities using...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the splitPos function. An attacker can cause unintended script execution by crafting a request path containing specific multi-byte Unicode characters, which manipulates the...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the splitPos function. An attacker can cause unintended script execution by crafting a request path containing specific multi-byte Unicode characters, which manipulates the...
GHSA-G6X7-JQ8P-6Q9Q webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule
Summary An attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WTCLOSESESSION capsule containing an excessively large Application Error Message. The implementation does not enforce the draft-mandated limit of 1024 bytes on this field, allowing ...
webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule
Summary An attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WTCLOSESESSION capsule containing an excessively large Application Error Message. The implementation does not enforce the draft-mandated limit of 1024 bytes on this field, allowing ...
CVE-2025-13650
An attacker with access to the web application ZeusWeb of the provider Microcom in this case, registration is not necessary, but the action must be performed who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Surname’ parameter of the ‘Creat...
CVE-2026-2276 Reflected Cross-Site Scripting in the Wix web application
Reflected Cross-Site Scripting XSS vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded...
PT-2026-7883
thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like ' or '1=1 to the username field to gain unauthorized access to user accounts...
Nsasoft SpotAuditor 安全漏洞
Nsasoft SpotAuditor is a advanced password recovery software developed by the US company Nsasoft. It is designed to restore passwords lost or forgotten from over 40 popular Windows programs and tools. Version 5.3.2 of Nsasoft SpotAuditor contains a security vulnerability; this vulnerability stems...
PT-2026-7941
Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endpoint. Attackers can trigger 100% CPU load by sending multiple concurrent requests to the /api.php endpoint with crafted parameters...
GHIA CamIP 安全漏洞
GHIA CamIP is a mobile monitoring application developed by the GHIA company. GHIA CamIP has a security vulnerability, which stems from a denial-of-service vulnerability in the password input field. This vulnerability could allow attackers to cause the application to crash...
InternetSoft FTP Navigator 安全漏洞
InternetSoft FTP Navigator is an FTP client software developed by InternetSoft Corporation. Version 8.03 of InternetSoft FTP Navigator contains a security vulnerability, which stems from a buffer overflow issue in custom command inputs, potentially leading to the application crashing...
PT-2026-7868
Name of the Vulnerable Software and Affected Versions webtransport-go versions 0.3.0 through 0.9.0 Description webtransport-go’s session implementation is susceptible to excessive memory consumption. An attacker can send a WT CLOSE SESSION capsule containing an excessively large Application Error...
Nsasoft Product Key Explorer 安全漏洞
Nsasoft Product Key Explorer is a product key search tool developed by the US company Nsasoft. It is used to recover and locate product keys for over 5,000 programs. Version 4.2.0.0 of Nsasoft Product Key Explorer contains a security vulnerability caused by a buffer overflow in the registration...
