CVE-2018-7935

CVE-2018-7935 POC 首先获取有效Session curl http://192.168.8.1/html/index.html | grep SessionID 操作说明：编辑 exploit.py，插入获取到的 SessionID 漏洞状态：已收到确认，补丁已发布...

BIT-TOMCAT-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2021-43857

CVE-2021-43857 CVE-2021-43857 ejecución de comandos en Gerapy Descargo de responsabilidad root@kitploit: El script es solo para fines de aprendizaje y referencia; no lo utilices para atacar sitios web de otras personas de forma malintencionada. Si se viola la ley o se cometen actos ilícitos, toda...

CVE-2026-86746

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

CVE-2026-85227 Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

PT-2026-78931

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description An expression injection issue exists in the link preview rendering of the resource-locator field. The editor directly splices the...

CVE-2026-61807 Snipe-IT: Stored DOM XSS via table selected-count IDs

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-61807

Snipe-IT versions before 8.6.2 are vulnerable to stored DOM XSS: a crafted manufacturer/supplier name flows into data-selected-count-id in bootstrap-table.blade.php, is decoded client-side, and is injected via jQuery .after(), executing JS in authenticated users' sessions. Fix is version 8.6.2. N...

EUVD-2026-62626

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-40509

OpenEMR before 8.3.0 is affected by a cross-site request forgery (CSRF) vulnerability in the DICOM viewer . The web_path GET parameter is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a malicious URL that causes an authenticated user holding...

Origin Validation Error

Overview typo3/cms-install is a TYPO3 extension install. The Install Tool is used for installation, upgrade, system administration and setup tasks. Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend and Install Tool. An attacker can invoke protected backend or Install Tool endpoints with an authenticated victim’s session by sending...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the condition.config process. An attacker can execute arbitrary operating system commands, read sensitive...

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...

CVE-2026-39923

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-71245

Red Hat CNA-LR concluded that this CVE is not valid...

EUVD-2026-53318

Mautic's getLeadIdsByFieldValueAction LeadBundle/Controller/AjaxController.php reads a field parameter from the request, sanitizes it only with InputHelper::clean which HTML-entity-encodes quotes and angle brackets but does not restrict other characters, and passes it into...

EUVD-2026-52486

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...