SmartAsset-SQLinj-CVE-2020-26525

SmartAsset-SQLinj-CVE-2020-26525 Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. Smart Asset - version 2020.7 CVE-2020-26525 ========================== HTTP Request: GET /API/api/Asset?assetCode=XXX-08-X-01-06-01&...

CVE-2026-90510

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-18741

CVE-2026-18741 - Stored XSS in Worksuite SaaS About CVE-2026-18741 is a Stored XSS vulnerability affecting Worksuite SaaS versions prior to 6.0.14. The issue is located in the Asset Management module. User-controlled input can be stored through fields such as: Location Description The stored inpu...

owasp-aibom

placeholder Put images you wish to link to in this folder link would be in form /assets/images/...

SmartAsset-UE-CVE-2020-26526

SmartAsset-UE-CVE-2020-26526 It is possible to enumerate valid usernames on the login page. CVE-2020-26526 An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is...

CVE-2025-32432-POC

Craft CMS CVE-2025-32432 Single-Target PoC Authorized testing only. This repository is intended for controlled lab environments, CTF platforms such as Hack The Box, internal validation, and defensive verification. Do not run this against systems you do not own or have explicit permission to test...

CVE-2026-54166

Shelf , a physical asset tracking platform, contains a Server-Side Request Forgery (SSRF) in its Asset CSV Content Import feature prior to version 1.20.3 . Authenticated users with the asset:import permission can bypass imageUrl validation using image-extension suffixes, path keywords, domain sub...

CVE-2026-89257 AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

CVE-2026-89257 AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

EUVD-2026-76069

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

CVE-2026-89257

AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce but omits the Category::userCanEditCategory() ownership check enforced by the s...

CVE-2026-69083_exploit

CVE-2026-69083 — SiYuan Unauthenticated SQL Injection Unauthenticated SQL injection in SiYuan a Go-based knowledge-base app via the asset-content search endpoint. POST /api/search/fullTextSearchAssetContent builds a raw SQL statement by concatenating the user-controlled query value straight into ...

LambdaGuard

LambdaGuard AWS Lambda is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code. LambdaGuard is an AWS Lambda auditing tool designed to...

FreeBSD : immich -- locked assets remain accessible through shared albums and links (fcc6917b-adbc-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fcc6917b-adbc-11f1-a655-3497f65b111b advisory. NVD reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089

A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...

w12scan-client

w12scan-client Network asset search and discovery engine, large-scale asset identification, graduation project, w12scan client program Design Philosophy The client's philosophy is to only process the data url, ip it receives, without automatically following 301 redirects based on URLs, nor scanni...

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...

ThreatSentry-AI

ThreatSentry AI: AI-Powered Threat Hunting Tool Automate external asset discovery, intelligently enrich with multi-source data, and leverage ensemble machine learning to predict and prioritize risk. Transform alert fatigue into actionable intelligence. 🚀 Mission Statement ThreatSentry AI eliminat...