1177 matches found
ids_bypass
Descargo de responsabilidad Estos programas son solo con fines educativos. No los use sin permiso. injectserver: Prueba de concepto para CVE-2018-6794. Si como servidor interrumpe el orden normal de los paquetes del handshake TCP de 3 vías e inyecta datos de respuesta antes de que se complete el...
WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection
Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...
CVE-2026-59815
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...
CVE-2026-86802
To Do List Member is a WordPress plugin that allows unauthenticated users to create arbitrary published posts and taxonomy terms due to missing authorization and nonce checks in its import routine. The plugin also fails to validate the source location it fetches imported data from, enabling unaut...
CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...
abrt: unsanitized systemd journal content written to dump directory files enables content injection
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...
Important: Red Hat Security Advisory: abrt security update
An update for abrt is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
Important: Red Hat Security Advisory: abrt security update
An update for abrt is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
abrt: unsanitized systemd journal content written to dump directory files enables content injection
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...
abrt: unsanitized systemd journal content written to dump directory files enables content injection
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...
RHEL 8 : abrt (RHSA-2026:69117)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69117 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...
RHEL 8 : abrt (RHSA-2026:69115)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69115 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...
WordPress Formidable Forms plugin 6.34 - Unauthenticated Stored Content Injection vulnerability
Unauthenticated Stored Content Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Formidable Forms versions 6.34...
CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...
CVE-2026-85641
CVE-2026-85641 is an unauthenticated stored content injection vulnerability in the Formidable Forms WordPress plugin, affecting versions before 6.35 (specifically identified in version 6.34). The root cause is that the plugin does not restrict who can set the updated_by parameter, which records t...
CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Astra Linux – Vulnerability in Rails
An XSS vulnerability exists in the Action View tag helpers versions 5.2.0 and below, which would allow an attacker to inject content if they can control the input into specific attributes...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...