CVE-2021-2109

Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network...

CVE-2024-50849

CVE-2024-50849: Stored XSS in the WorldServer v11.8.2 A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code. An authenticated high-privileged user must go to the "Rules" page...

CVE-2021-30146

CVE-2021-30146 Seafile 7.0.5 Persistent XSS Suggested description: Application Server Version: 7.0.5 Seafile is vulnerable to Persistent XSS via share library functionality. Additional Information: Seafile is an open source, self-hosted file sync and share solution with high performance and...

exploit-CVE-2016-8016-25

McAfee Virus Scan for Linux multiple remote flaws THIS EXPLOIT AND ALL THE CODE IN THIS REPO WERE REMOVED TO AVOID ANY PROBLEMS REGARDING VIOLATING ANY MCAFEE LICENSE McAfee VirusScan Enterprise for Linux is a enterprise antivirus solution by Mcafee. Its unique, Linux-based on- access scanner...

CVE-2026-38698-and-CVE-2026-38699

Research on Wyze Cam Pan v3 Slides Reference CVE-2026-38698 Attack Name Heap Overflow on tutkpacketalloc function in tutkavserver Additional Details Afftected product TUTK SDK v.3.1.10.0 through v.4.3.8.1 Affected Component tutkpacketAlloc function Attack Vector An authenticated attacker must sen...

CVE-2024-21689

CVE-2024–21689 RCE Bamboo Data Center and Server Atlassian CVSS Score - 7.6 🔥 Description This High severity RCE Remote Code Execution vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE Remote Code...

CVE-2025-54897-LAB

Lab: CVE-2025-54897 - Deserialization Vulnerability in Microsoft Office SharePoint 🚀 Overview This lab demonstrates a deserialization vulnerability in Microsoft Office SharePoint that enables remote code execution RCE. The issue arises from improper handling of untrusted serialized data within...

CVE-2023-46003

CVE-2023-46003 Stored XSS in i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to Stored XSS vulnerability. These could allows remote authenticated attackers low or high privilege to stores dangerous data xss payload or fake html page in a database, it will be trigger the xss payload...

CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

CVE-2022-48311

CVE-2022-48311 HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B HTTP configuration page Cross Site Scripting XSS Vulnerability Description Cross Site Scripting XSS in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number...

Security Bulletin: IBM MQ Appliance is affected by an improper conversion vulnerability (CVE-2026-12670)

Summary IBM MQ Appliance has addressed an improper conversion vulnerability that could allow an authenticated attacker to cause a denial of service through a specially crafted message during character set conversion. Vulnerability Details CVEID:CVE-2026-12670 DESCRIPTION: IBM MQ could allow an...

CVE-2026-115454

An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is no...

EUVD-2026-98401

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker ...

CVE-2026-89198

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the...

EUVD-2026-98166

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library CVE-2025-26240 for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch intern...

PT-2026-111135

Name of the Vulnerable Software and Affected Versions SAP S/4HANA affected versions not specified Description Insufficient input validation in the rule definition functionality, which uses a domain-specific scripting language, allows an authenticated attacker with specific business privileges to...

CVE-2026-109661 Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial da...

CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

EUVD-2026-97559

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorize...

CVE-2026-109334 SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...