CVE-2026-59670 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

CVE-2026-59670

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw exists within the "nomListaValidacion" parameter at the endpoint "/es/validationslists/assignList/Employee/45659" . Successful exploitation could allow an attacker to trick a user into executing arbitrary ...

CVE-2026-59670 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

CVE-2019-11043-Vulnerability

協力者: Olaf Madejski, Andrew Masone, Nate Desany PHP-FPM リバーストンネルの悪用と永続化のデモンストレーション CVE-2019-11043 — Debian PHP-FPM パス処理の脆弱性 プロジェクト概要 2019年10月、Debian Security Advisory の研究者 Emil Lerner と Andrew Danau は、PHP-FPM の重大な脆弱性について Debian コミュニティに警告する通知を公開しました。PHP-FPM のパス処理コードにおける検証不足 のため、攻撃者は特定の NGINX +...

-CVE-2021-44790

CVE-2021-44790 CVE-2021-44790 설명 CVE-2021-44790은 Apache HTTP Server의 modlua, 특히 버전 2.4.51 및 그 이전 버전에 있는 시스템 수준 보안 취약점을 설명합니다. 이 취약점은 r:parsebody 함수가 multipart/form-data HTTP 요청을 부적절하게 처리할 때 발생하며, 일반적으로 비표준 form 데이터 전송으로 인해 유발됩니다. 이 문제는 서비스 거부 가능성을 높일 뿐만 아니라, 정교하게 구성된 요청을 통해 원격 코드 실행 기회를 열어줍니다...

EUVD-2026-91319

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

CVE-2026-59669

The Repasat application is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the "name" parameter of the endpoint “/es/attachmenttypes/update/203336” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their browser. N...

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — CVE-2026-64638 の PoC XSS2Shell CVE-2026-64638 チェーンの教育用 PoC です。 pwn.ai が独自に発見し、2026年8月7日に公開した、WordPress Core の 認証前 XSS → RCE の脆弱性です。 目次 1. エグゼクティブサマリー 2. 法的免責事項 3. チェーンアーキテクチャ 4. 要件 5. リポジトリ構成 6. クイックスタートガイド 7. エクスプロイトの検証 8. 追加ドキュメント エグゼクティブサマリー CVE-2026-64638 は、WordPress のログイン画面...

[SECURITY] [DSA 6538-1] redis security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6538-1 [email protected] https://www.debian.org/security/ Aron Xu October 02, 2026 https://www.debian.org/security/faq -...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-102514

A flaw was found in PeaZip. When decompressing PEA archives, the application fails to properly validate compressed block sizes, resulting in an out-of-bounds write vulnerability. By convincing a victim to open or extract a specially crafted archive file, an attacker could exploit this flaw to...

CVE-2026-18574

cve-id 寄付 このプロジェクトの維持にご協力ください このプロジェクトが役立つと思われた方は、PayPal または ABA Mobile を通じて、継続的な維持管理へのご支援をご検討ください。 ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ ご寄付の10%は、Kantha Bopha Children's Hospital に寄付されます。 | お支払い方法を選択してください ABA Mobile でスキャン · クリックして拡大 ---|--- ⚡ 簡単な使い方 GitHub...

OpenWire-CVE-2023-46604-Investigation

OpenWire-CVE-2023-46604-Investigation OpenWire 랩 제 근무 시간 동안 2단계 SOC 분석가로서, 1단계 분석가로부터 공개적으로 접근 가능한 서버가 여러 의심스러운 외부 IP 주소와 통신하고 있다는 에스컬레이션을 받았습니다. 이에 응답하여, 표준 사고 대응IR 절차를 시작했으며, 여기에는 영향을 받은 서버를 네트워크에서 격리하여 측면 이동 및 잠재적인 데이터 유출을 방지하는 것이 포함되었습니다. 그런 다음 추가 조사를 위해 NSM 플랫폼에서 패킷 캡처PCAP 파일을 획득했습니다. 제 목표는...

[SECURITY] [DLA 4814-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4814-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 02, 2026 https://wiki.debian.org/LTS -...

thm-ice-icecast-rce-privesc

TryHackMe — Ice: Icecast 2.0.1 RCE と Windows 権限昇格 プラットフォーム: TryHackMe ターゲットOS: Windows 7 / Windows Server 2008 R2 難易度: 簡単 カテゴリ: バッファオーバーフロー RCE, ローカル権限昇格 概要 このレポートは、TryHackMe 上の Ice マシンの完全な侵害プロセスを、初期偵察から SYSTEM レベルの権限昇格までを文書化しています。ターゲットは、古い Icecast 2.0.1 ストリーミングメディアサーバーを公開しており、細工された HTTP...

cve-2023-51385

CVE-2023-51385の検証 まず、/.ssh/configに以下の内容を追加する必要があります host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p .gitmodulesファイルの記述にはコマンドインジェクションが存在します url = ssh://echo helloworld cve.txtfoo.example.com/bar 設定が完了したら、以下のコマンドを実行してトリガーします git clone...

Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report

Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report このリポジトリには、Shellshock CVE-2014-6271 に対して脆弱な内部 CGI エンドポイントに到達した Blind SSRF 脆弱性の悪用に成功したことを示す、プロフェッショナルなバグバウンティレポートが含まれています。リモートコマンド実行は、帯域外 OAST DNS コールバックを使用して確認され、完全な攻撃チェーン、技術的分析を示しています。...

session_reaper_lab

CVE-2025-54236 - SessionReaper Lab CVE-2025-54236SessionReaper의 실제 데모를 위한 Docker 환경: Magento Open Source 2.4.7에서 PHP 객체 역직렬화를 통한 RCE. 통제된 환경에서만 사용하십시오. 명시적 권한 없이 시스템에 대해 실행하지 마십시오. 취약점 정보 CVE-2025-54236 은 Magento Open Source 및 Adobe Commerce 2.4.7 이하 버전에 영향을 미칩니다...

EUVD-2026-91253

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-93756 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...