6617 matches found
CVE-2021-21220
First install: https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Winx64/848005/ Chrome version: 90.0.4403.0 install chrome-win.zip 1. node server.js run ./chrome.exe --no-sandbox go to localhost:8888 Note that the CVE which this exploits relies on is CVE...
CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS
Credits to @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main for details read: https://mizu.re/post/abusing-client-side-desync-on-werkzeug Tested On Chromium 119.0.6045.123 built on Debian trixie/sid, running on Debian kali-rolling...
CVE-2025-56800
CVE-2025-56800 Local Authentication Bypass Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-290: Authentication Bypass by Spoofing CVSS : 5.1 MEDIUM Vector String : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N...
CVE-2024-57175
CVE-2024-57175: Stored Cross-Site Scripting XSS in PHPGURUKUL Online Birth Certificate System v1.0 Description A stored Cross-Site Scripting XSS vulnerability was identified in PHPGURUKUL Online Birth Certificate System v1.0 in the /user/certificate-form.php page. This vulnerability allows...
CVE-2024-41290
CVE-2024-41290 FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data Additional Information: FlatPress CMS version 1.3.1 insecurely stores authentication-related data, including usernames and hashed passwords, directly in client-side cookies. This practice...
CVE-2026-114653
A client-side encryption schema construction component in the MongoDB C Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side...
CVE-2026-114650
A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...
EUVD-2026-108325
A client-side encryption schema construction component in the MongoDB C Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side...
CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...
CVE-2026-114650
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause sensitive data designated for client-side field-level encryption to be written in plaintext . Under specific platform text-encoding configurations, an internal name conversion loses information, causing the encry...
EUVD-2026-108319
A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...
CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
A flaw in the client-side encryption support of the MongoDB .NET/C driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer...
CVE-2021-28378
CVE-2021-28378 Details about this CVE here. This CVE targets a missing string escaping on the client-side from content fetched from the server. It enables an attacker to inject arbitrary code easily, by creating a comment on an issue or a pull request. This was introduced in commit...
Learn-SecByte-CTF-Labs-Collection-Windows-Kernel-Exploits-Client-Side-Browser-Attacks
Learn-SecByte-CTF-Labs-Collection-Windows-Kernel-Exploits-Clie...
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
SummaryPyMongo passed the KMS endpoint of a data key verbatim into parsehost, which returns any string ending in .sock unchanged instead of validating it as a hostname and port. The driver's connection code then treats such an address as a Unix domain socket path and connects to it with AFUNIX...
CVE-2026-63157 Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...
CVE-2026-96948
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver csc.sys allows an authorized attacker to disclose information locally...
CVE-2026-83699
Stack-based buffer overflow in Windows Client-Side Caching CSC Service allows an authorized attacker to elevate privileges locally...