455184 matches found
CVE-2025-12674
CVE-2025-12674 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 🐚 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 📝 Description The KiotViet Sync plugin for WordPress versions up to and including 1.8.5 is vulnerable to arbitrary file uploads, due to missing file type...
CVE-2013-2977
IBM Lotus Notes PNG Integer Overflow - CVE-2013-2977 IBM Lotus Notes is the client of a collaborative client-server plataform, being IBM Lotus Domino the application server. The email-client capability is one of its most important and used features. IBM Lotus Notes fails to correctly parse a PNG...
CVE-2018-16370
CVE-2018-16370 In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.More details see https://github.com/lazyphp/PESCMS-TEAM/issues/2...
CVE-2026-5203
CVE-2026-5203 — CMS Made Simple ≤ 2.2.22 RCE Path Traversal + Arbitrary File Upload Summary The UserGuide module's XML import functionality in CMS Made Simple ≤ 2.2.22 fails to sanitize user-supplied filenames, allowing an authenticated administrator to upload arbitrary files e.g. PHP web shells...
CVE-2026-75650
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 - Adobe I am @abraxasnull. Loopback lab. The client is CVE-2026-75650-Abraxas-Labs.py. Unauthenticated email-template SSTI. A GraphQL Store header plants...
CVE-2026-6815
CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 Path Traversal & Arbitrary File Write Authenticated This repository contains a Proof of Concept PoC exploit for CVE-2026-6815, an arbitrary file write and path traversal vulnerability in Casdoor. The vulnerability has been fixed in version 3.54.1...
CVE-2026-87690
The Metasploit Framework post module post/appleios/gather/iosimagegather is affected by a relative path traversal vulnerability CWE-22. The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the loc...
CVE-2026-21138
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications...
CVE-2026-21128
Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges...
CVE-2026-21129
Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...
CVE-2026-21130
Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...
CVE-2026-21125
Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code...
CVE-2026-21131
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device...
CVE-2026-21132
Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability...
CVE-2026-21120
Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege...
CVE-2026-21124
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code...
CVE-2026-21122
Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...
CVE-2026-21114
Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...
omapi-cve-2015-6606-exploit
Simple Exploit for Verification of CVE-2015-6606 This is a simple exploit to verify a code injection vulnerability that exists in the SEEK smartcard service versions 3.1.0 and below CVE-2015-6606, Google internal bug ANDROID-22301786. The vulnerability allows specially crafted Android application...
