CVE-2026-42208_lab

SQL-инъекция в LiteLLM Proxy GHSA-r75f-5x8p-qvmc Среда воспроизведения SQL-инъекции в процессе аутентификации по API-ключам в LiteLLM Proxy. Сводка по уязвимости Пункт| Детали ---|--- Уведомление| GHSA-r75f-5x8p-qvmc Тип| SQL-инъекция CWE-89 Критичность| Критическая Затронутые версии| litellm...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

SummaryWhen enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instea...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

ImpactThe vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted.Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as...

Log-4j-scanner

log4j-scan Полностью автоматизированный, точный и обширный сканер для поиска уязвимых log4j хостов Возможности Поддержка списков URL-адресов. Фаззинг более чем 60 HTTP-заголовков запроса а не только 3-4 заголовков, как в ранее представленных инструментах. Фаззинг параметров данных HTTP POST...

CVE-2026-17053

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2025-6389

CVE-2025-6389 Sneeit Framework 📡 Ne manquez pas la prochaine fuite. Suivez @KNxploited sur Telegram — la chaîne incontournable pour les CVE fraîchement divulguées, les exploits fonctionnels et la recherche en sécurité d'élite. Les premiers informés. Les premiers à agir. 🧠 Présentation CVE-2025-63...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053

The Zephyr RTOS SMBus driver API contains a vulnerability where smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() are exposed as syscalls. These syscalls fail to perform K_SYSCALL_MEMORY_READ/WRITE validation on the caller-supplied struct smbus_callback *cb pointer, forwarding it direc...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

EUVD-2026-90880

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2020-15227

CVE-2020-15227 AVERTISSEMENT ! Je décline toute responsabilité quant à l'utilisation de cet outil dans un environnement réel, ne le faites PAS. Ce bidule est uniquement destiné à démontrer et à tester des choses pour les administrateurs système. J'ai créé cet exploit suite à la publication d'un C...

CVE-2021-44228

CVE-2021-44228 PoC Log4Shell ⚠️ Предупреждение: Данный инструмент предназначен только для образовательных целей, исследований в области безопасности и контролируемых тестовых сред. Использование его против систем без явного разрешения незаконно и полностью лежит на ответственности пользователя. 📌...

roundcube-cve-2021-44026

Roundcube CVE-2021-44026, une injection SQL Ce dépôt contient un exploit de démonstration pour une injection SQL dans Roundcube. Avertissement : Ce code est destiné uniquement à des fins éducatives et à aider les équipes de sécurité à identifier les vulnérabilités dans leurs instances Roundcube. ...

CVE-2026-96200

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

CVE-2026-96173

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

EUVD-2026-90519

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

CVE-2026-96200

The Payments for Hubtel WordPress plugin (versions before 1.0.2 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify that payment notifications received via the plugin's payment callback actually originate from the legitimate payment provider....

EUVD-2026-90518

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...