CVE-2025-55854-PoC

CVE-2025-55854 - 保存型クロスサイトスクリプティング（XSS）の脆弱性 脆弱性の概要 CVE ID: CVE-2025-55854 脆弱性の種類: 保存型クロスサイトスクリプティング（XSS） 深刻度: 高 影響を受けるコンポーネント: ユーザープロフィールのBioフィールド 影響を受けるアプリケーション: FreelanceHub https://github.com/nooncarlett/FreelanceHub 説明...

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo Bio-Formats ≤ 8.3.0 は、画像処理中に攻撃者が制御する .bfmemo キャッシュファイルの安全でない Java デシリアライゼーションを実行します。細工された .bfmemo は、信頼できないデータのデシリアライゼーションを引き起こす可能性があります（DoS／ロジック操作、ガジェットチェーンが存在する場合は潜在的に RCE）。 安全な再現（ローカルのみ）...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ その後、その作成者が作成した投稿を表示してXSSをトリガーします。 動画POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

CVE-2021-24545

CVE-2021-24545 현재는 plugin으로 배포가 중단되어 있는 플러그인에서 발견된 XSS 취약점입니다. WordPress Plugin HTML Author Bio description XSS 해당 취약점은 /wp-admin/profile.php에서 description 매개 변수에 대한 부적절한 유효성 검사로 인해 발생합니다. 원격의 공격자는 악의적으로 조작된 HTTP 요청을 전송하여 공격할 수 있다. 설치 및 실행 순서 1. WordPress 설치 설치를 진행할 때, docker-compose.yml 파일에서...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: block: Fixed the issue of iterating over an empty bio with bioforeachfolioall. If the bio contains no data, biofirstfolio calls pagefolio using a NULL pointer, resulting in a buffer overflow error. We’ve moved the test that check...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the “block” layer, do not call “rqqosops-donebio” if the bio data structure is not being tracked. The “rqqos” framework is only applied on request-based drivers. Therefore: 1 The “rqqosdonebio” function is not necessary for...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: md/raid5: Unnecessary bioput calls in raid5readonechunk have been removed. When performing chunk-sized reads on disks with badblocks, it was observed that calls to biofree and bioput were duplicated...

PT-2026-105769

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

PT-2026-103461

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description The ssl.SSLContext.wrap bio function fails to require the server hostname argument to be non-null when ssl.SSLContext.check hostname is enabled. Due to a missing parameter check in SSLObject, ...

PT-2026-98844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pmem submit bio function where a REQ PREFLUSH error is recorded but the process continues to copy bio data. This can lead to the error being overwritten by a...

kernel: blk-mq: pop cached request if it is usable

A flaw was found in the Linux kernel's blk-mq component. This use-after-free vulnerability occurs when a task attempts to submit a bio a data structure for I/O operations to blk-mq. If the task is interrupted and sleeps after checking for a cached request but before using it, the cached request c...

CVE-2026-54506

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506

Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fixed the memory leak related to ‘conf-biosplit’. In the error path of raid10run, ‘conf’ needs to be freed. However, ‘conf-biosplit’ is not freed, resulting in a memory leak. Since there are three places where ‘conf’...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed an issue where the extent map was used after freeing memory when adding pages to compressed Bio data structures. In the function addrabiopages, we access the extent map to calculate ‘addsize’. After releasing the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Block: Initialize the integrity buffer to zero before writing it to the media. The metadata added by biointegrityprep uses the plain kmalloc function, which results in random kernel memory being written to the media. For PI...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: A fix was made to avoid a use-after-free condition related to cached IPU bio. The xfstest generic/019 report a bug: Kernel BUG: At mm/filemap.c:1619! RIP: 0010: folioendwriteback+0x8a/0x90 Call Trace:...