CVE-2026-4791

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

Centry

Centry 警告：这是实验性软件。很可能包含错误。 更新 如果你已经安装了 Centry，请运行 git pull 更新到最新版本。最新更新使其在抵御重放攻击方面更加安全。 简介 Centry 是一个紧急按钮（panic button），旨在保护用户免受冷启动攻击、直接内存访问攻击以及其他实时系统威胁。Centry 在部署了全盘加密且没有交换分区/页面文件的系统上最为有效。紧急功能可以通过 GUI 或网络请求（通过浏览器、智能手机等）触发。收到紧急指令后，Centry 将尝试从内存中移除敏感密钥，安全地覆写 RAM，然后强制关机。 功能 用户友好的 GUI 界面...

CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Big Blue Button 中 LibreOffice 文件外泄漏洞的概念验证 这些 ODT 文件展示了如何利用服务器端 LibreOffice 渲染（例如 BigBlueButton）中可能发生的文件外泄漏洞。 背景： https://blog.hboeck.de/archives/902-File-Exfiltration-via-Libreoffice-in-BigBlueButton-and-JODConverter.html...

CVE-2026-98203

A flaw was found in the Linux kernel's SoC System on Chip button array driver. The driver fails to verify that the button descriptor package contains entries before accessing them during device initialization. This issue may allow an invalid device configuration to trigger an out-of-bounds memory...

BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

TaskManager-Button-Disabler

TaskManager-Button-Disabler 禁用/重命名任务管理器按钮的简单方法。 安装 git clone https://github.com/Mrakovic-ORG/TaskManager-Button-Disabler cd TaskManager-Button-Disabler\TaskManager Button Disabler dotnet build 功能特性 重命名终止进程按钮 禁用终止进程按钮 适用于任务管理器、ProcessHacker等 实际效果...

Bolt-CMS-3.6.2---Cross-Site-Scripting

Bolt CMS 3.6.2 - 跨站脚本漏洞 Bolt CMS 3.6.2 - 跨站脚本漏洞 CVE-2018-19933 https://vulners.com/cve/CVE-2018-19933 概念验证 要利用此漏洞，Bolt CMS 3.6.2 允许通过文本输入点击预览按钮触发 XSS，如 Configured 和 New Entry 的 Title 字段所示。 POST /preview/page HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:63....

CVE-2025-69581

CVE-2025-69581 Chamillo LMS 1.11.2 中发现了一个问题。Social Network /personaldata 端点在注销后仍然暴露完整的敏感用户信息，因为缺少适当的缓存控制。使用浏览器后退按钮会恢复所有个人数据，允许同一设备上的未经授权用户查看机密信息。这导致用户画像分析、身份冒充、定向攻击以及严重的隐私风险。发现者：Rivek Raj Tamang RivuDon，印度锡金。 受影响产品：Chamilo LMS 受影响版本：1.11.2 发现者：Rivek Raj Tamang RivuDon，印度锡金 漏洞详情 信息泄露 摘要 该漏洞允许未经授权访...

CVE-2022-46638

CVE-2022-46638 涉及 AppLock（版本 5.6.2）的漏洞，这是一款流行的安卓应用，在全球超过150个国家拥有超过1亿用户。 PoC 只需多次点击返回键即可解锁由 AppLock 保护的应用。 1. 打开被 AppLock 锁定的应用。 2. 不要输入任何 PIN 码/密码。 3. 点击/按下返回键，观看广告然后关闭广告。 4. 重复步骤 1-3 多次。 5. 砰！☺ 被 AppLock 保护的应用就打开了。 证据 https://youtube.com/shorts/9-8ImPRvhUU?feature=share...

PT-2026-106532

In the Linux kernel, the following vulnerability has been resolved: Input: soc button array - check btns desc-package.count Check that btns desc-package.count is not 0 before accessing btns desc-package.elements0...

CVE-2024-25293

MJML 本地代码执行 PoC CVE-2024-25293 漏洞的概念验证（PoC）。 mjml-app v3.0.4 和 3.1.0-beta 被发现存在远程代码执行（RCE）漏洞。 此仓库中包含一个易受攻击的示例应用程序及其概念验证（POC）利用程序。 作为 PoC，其中有一个用于自动化该过程的 Python 文件。 1.漏洞概述： 漏洞主题：本地代码执行 漏洞版本：mjml-app 3.0.4-win 和 mjml-app 3.1.0-beta 攻击类型：远程代码执行 攻击组件：在受影响源代码文件中的 'mj-button' 标签内，'href' 属性可导致本地代码执行。 保留...

EUVD-2026-52744

@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Summary The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitra...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin, in versions 1.8 through 2.0.5 , is vulnerable to unauthenticated payment amount manipulation . The root cause is that the plugin fails to derive the payment amount on the server, instead relying on a client-supplied field . This allows an ...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

EUVD-2026-91213

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

WordPress Easy PayPal & Stripe Buy Now Button plugin 1.8-2.0.5 - Unauthenticated Payment Amount Manipulation vulnerability

Unauthenticated Payment Amount Manipulation vulnerability discovered by JunHee CHO in WordPress Plugin Easy PayPal Buy Now Button versions 1.8-2.0.5...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...