35 matches found
CVE-2026-81496
Summary "POST /1.0/instances" with an "application/octet-stream" body instance backup import reads the instance name from the tarball's "backup/index.yaml" verbatim and uses it as an on-disk path segment. A project user with the "cancreateinstances" entitlement can set "name:...
Regular Expression Denial of Service (ReDoS)
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via unsanitized user-controlled input passed to dynamically constructed regular expressions in the import handlers image.js, importer-content-file-handler.js,...
Regular Expression Denial of Service (ReDoS)
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via unsanitized user-controlled input passed to dynamically constructed RegExp objects in the import handlers image.js, importer-content-file-handler.js,...
CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
CVE-2026-50162
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through...
CVE-2026-50163
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...
CVE-2026-50163: Improper Limitation of a Pathname to a Restricted Directory
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", " /payload.tar.gz/evilcwdlink" to resolve header.Linkname...
CVE-2026-54004
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...
CVE-2026-54004
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...
CVE-2026-54004 Kirby: Access to files of top-level drafts is not protected by permissions
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...
CVE-2026-54004 Kirby: Access to files of top-level drafts is not protected by permissions
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the content.fileRedirects process. An attacker can gain unauthorized access to files in top-level drafts by directly requesting clean file URLs, bypassing authentication and authorization checks. This is only...
EUVD-2026-20823
A vulnerability was determined in code-projects Simple IT Discussion Forum 1.0. The impacted element is an unknown function of the file /pages/content.php. This manipulation of the argument postid causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...
📄 Samsung QuramDng Out-Of-Bounds Write
Samsung QuramDng has an invalid LossyJpeg component assumption that leads to an out-of-bounds write. BACKGROUND Samsung Android uses an internal DNG decoding library, QuramDng in libimagecodec.quram.so, to decode images in com.samsung.ipservice and com.samsung.gallery3d. Samsung Gallery will deco...
CVE-2025-11102
CVE-2025-11102 affects Campcodes Online Learning Management System (v1.0). A vulnerability in an unknown function within /admin/edit_content.php allows manipulation of the Title parameter to trigger SQL injection. Exploitation can be conducted remotely, and public exploits are noted. Several sour...
CVE-2025-11077 Campcodes Online Learning Management System add_content.php sql injection
A vulnerability was determined in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/addcontent.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclose...
pentest_compilation
It is an offensive tool for Windows. The repository contains a compilation of commands, tips, and scripts used for penetration testing and red teaming exercises. The provided code snippet is an XML file named "detalle.SettingContent-ms" located in the "Phishing" directory. This file appears to be...
SourceCodester Simple Company Website Security Vulnerabilities
SourceCodester Simple Company Website is a simple company website from SourceCodester, Inc. A security vulnerability exists in SourceCodester Simple Company Website version 1.0, which originates from an unrestricted upload due to incorrect manipulation of the parameter img in the file...