EUVD-2026-104853

A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system...

EUVD-2026-104852

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system...

CVE-2026-43846

A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution...

CVE-2026-43846

CVE-2026-43846 involves a stack-based buffer overflow vulnerability located within a non-functional feature . An authenticated attacker could potentially leverage this flaw to achieve code execution . While the vulnerability is documented, the specific software product, affected versions, and rem...

CVE-2026-43835

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently...

CVE-2026-113465

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Stormshield’s web administration panel . An attacker can execute malicious scripts by crafting a URL containing a payload within a specific parameter and tricking an authenticated administrator into visiting it. The impact involves hi...

CVE-2026-113465 Possible DOM XSS in SNS Web Administration Portal

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into...

CVE-2026-43835

A vulnerability exists in the firmware upgrade functionality that allows an authenticated attacker to upload a forged firmware upgrade file . This flaw could lead to the permanent compromise of the affected device. Specific details regarding the affected product, software version, root cause, and...

EUVD-2026-104830

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently...

CVE-2026-43835

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently...

CVE-2026-113407 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113407

BA-Workflow , developed by YS-infoware , contains a SQL Injection vulnerability (CWE-89). Authenticated remote attackers can exploit this flaw to inject arbitrary SQL statements, potentially allowing them to read, modify, and delete database contents. No specific patch version or remediation step...

CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113406

The BA-Workflow software developed by YS-infoware is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to inject arbitrary SQL statements, potentially resulting in the unauthorized reading, modification, or deletion of database contents. Specific information ...

CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113405

The software BA-Workflow , developed by YS-infoware , is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to execute arbitrary SQL statements, potentially resulting in the ability to read, modify, and delete database contents . No specific affected versions,...

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 CVSS v4 score: 8.4, could allow an attacker to place a specially-crafted DLL in a directory the...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE in WordPress WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file With wavefile npm $ make make-wav Step4...

CVE-2026-113402

The ArmorX Spam application developed by ArmorX Global Technology contains a Local File Inclusion (LFI) vulnerability. Authenticated remote attackers can exploit path traversal to force the application to include PHP files from directories outside the intended scope. No specific remediation or in...