BadOutlook

Bad Outlook A simple PoC which leverages the Outlook Application Interface COM Interface to execute shellcode on a system based on a specific trigger subject line. By utilizing the Microsoft.Office.Interop.Outlook namespace, developers can represent the entire Outlook Application or at least...

Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

TOTVS Fluig <= 1.7.0 - Arbitrary File Read

TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter. id: CVE-2020-29134 info: name: TOTVS Fluig = 1.7.0 - Arbitrary File Read author: ls4ss...

CVE-2022-32548-RCE-POC

CVE-2022-32548-RCE-POC DrayTek unauthenticated remote code execution vulnerability CVE-2022-32548 in /cgi-bin/wlogin.cgi via username field Technical details The web management interface of the vulnerable DrayTek devices is affected by a buffer overflow on the login page at /cgi-bin/wlogin.cgi. A...

Malicious code in wallet-backup-tool (RubyGems)

RubyGems runs this gem's native extension script ext/wallet-backup-tool/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in eth-address-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

BIT-RABBITMQ-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-100370 DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

CVE-2026-100370

The DOMSanitizer library for PHP 7.3+ is vulnerable to an input-validation defect in its isDangerousUrl() method prior to version 1.0.15 . While the sanitizer correctly rejects the "javascript:" scheme, it only rejects the "data:" scheme if the literal substring "onload" is present. This allows a...

CVE-2026-67236

A flaw was found in rabbitmq-server. This vulnerability allows information disclosure due to insecure handling of authentication cookies following a login request. The application stores base64-encoded user credentials in a cookie that lacks essential security flags, such as Secure, HttpOnly, and...

intigriti-0926

Critter Gallery — SQL Injection Write-up Intigriti — Septem...

CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

PT-2026-95819

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bdd Description The software writes Model Context Protocol MCP authentication tokens, which are passed via URL query parameters, into plaintext application logs without redaction. This allows attackers w...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

rabbitmq-server: rabbitmq-server: Information disclosure via insecure authentication cookies

A flaw was found in rabbitmq-server. This vulnerability allows information disclosure due to insecure handling of authentication cookies following a login request. The application stores base64-encoded user credentials in a cookie that lacks essential security flags, such as Secure, HttpOnly, and...

CVE-2026-78000

J2Store , a Joomla e-commerce extension by j2commerce.com , is affected by two related issues. Four task handlers in the cart controller accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain (o...

MAL-2026-14199 Malicious code in txs-runner-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9d5d94b7f75bbe8bca33eb382bfb986e68b7f0307cad7e9626da103192f254 The package advertises itself as generating random transaction data, but its main API method getTransactions invokes loadtransactiondata, which reads...