CockpitCMS-Arbitrary-File-Upload--XSS---Assets

Cockpit CMS 2.7.0 Caricamento File - XSS Autore: Sergio Descrizione: La vulnerabilità di caricamento file in Cockpit CMS 2.7.0 consente a un attaccante locale di caricare un file PDF con XSS nascosto. Vettori di attacco: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L POC: Questa è la versione del software...

EUVD-2026-67306

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-75814

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

CVE-2026-38821

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...

Dropbear_CVE-2013-4434

DropbearCVE-2013-4434 dropbearCVE-2013-4434.sh Questo script verifica la CVE-2013-4434 https://vulners.com/cve/CVE-2013-4434. Il server SSH Dropbear precedente alla versione 2013.59 genera messaggi di errore per un tentativo di accesso fallito con ritardi temporali differenti a seconda che...

CVE-2026-37710

CVE-2026-37710 is a cross-site scripting (XSS) vulnerability in Omeka S v.4.2.0 , triggered through the site navigation custom URL function , allowing a remote attacker to execute arbitrary code with user interaction. The CNA-assigned CVSS 3.1 score is 6.1 (Medium) with a changed scope, reflectin...

CVE-2023-43342-Quick-CMS-Stored-XSS---Languages-Frontend

Quick CMS Stored XSS v6.7 Author: Sergio Description: A Cross-Site Scripting XSS vulnerability in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Front and back end - Pages in the Languages Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2020-8958

Una proof of concept per CVE-2020-8958 scritta in Python. Lo script restituirà il contenuto di /etc/passwd se ha successo. CVE-2020-8958 I dispositivi Guangzhou 1GE ONU V2801RW 1.9.1-181203 fino a 2.9.0-181024 e V2804RGW 1.9.1-181203 fino a 2.9.0-181024 consentono ad attaccanti remoti di eseguire...

EUVD-2026-63376

aiosmtplib: STARTTLS response injection...

CVE-2026-78495

A server-side request forgery (SSRF) vulnerability in the WatchGuard Dimension product, specifically in the Remote Backup Connection Test configuration, allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. The CVSS 4.0 score is 5.3 (MEDIUM...

CVE-2026-82072

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-22889-Plone-v6.0.9

Prodotto: Plone CMS Versione: v6.0.9 Data trovata: 10.01.2024. Data segnalata: 10.01.2024. Tipo di vulnerabilità: Controllo degli accessi errato. ID CVE: CVE-2024-22889 Descrizione: A causa di un controllo degli accessi errato in Plone versione v6.0.9, gli attaccanti remoti possono visualizzare e...

cve-2019-14220

Riepilogo Un metodo non protetto in un servizio bstutils in BlueStacks 4.120 e precedenti su Mac e 4.110 e precedenti su Windows permette a un attaccante locale di leggere il contenuto di file arbitrari con privilegi di sistema. Descrizione BlueStacks è un emulatore Android disponibile per sistem...

CVE-2026-75548 Ebyte NE2-D11 Improper Restriction of Rendered UI Layers or Frames

The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive...

CVE-2026-75548

CVE-2026-75548 affects the web management interface of the Ebyte NE2-D11 device. The interface lacks a frame-restriction mechanism (e.g., X-Frame-Options or CSP frame-ancestors), allowing an unauthenticated remote attacker to embed the interface within a crafted external page. This enables a clic...

CVE-2026-75814

Ebyte NE2-D11 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in its web management interface. The device does not adequately verify the origin or authenticity of submitted requests, allowing an unauthenticated remote attacker to lure an authenticated administrator to a crafted p...

CVE-2026-75814 Ebyte NE2-D11 Cross-Site Request Forgery

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

CVE-2023-37597

CVE-2023-37597 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Eliminazione di un gruppo utenti Disclaimer: Questo repository è destinato esclusivamente a scopi educativi e di ricerca sulla sicurezza autorizzata. Non utilizzare questo exploit contro sistemi di cui non sei proprietario o...

honeypot

🍯 Honeypot-Forschungsprojekt Was ist ein Honeypot Ein Honeypot ist ein Computersystem oder Netzwerk, das absichtlich verwundbar für Hacker gelassen wird, um potenzielle Sicherheitsbedrohungen zu erkennen, zu analysieren und darauf zu reagieren. Das Ziel eines Honeypots ist es, Informationen über...

CVE-2026-81934

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in...