SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare — Полная цепочка эксплуатации RCE в n8n 1. Резюме и обзор В данном документе представлен детерминированный технический реконструкционный анализ уязвимости CVE-2026-21858, внутреннее...

CVE-2025-57926

Sink: Согласно механизму ядра WordPress, XSS предотвращается в содержимом записей, но с этим плагином содержимое кодируется, а затем декодируется при рендеринге, что непреднамеренно создаёт уязвимость XSS." PoC: Полезная нагрузка в base64 — это PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==...

CVE-2025-54677

Sink: Слабая проверка проверяет только Content-Type, что приводит к уязвимости произвольной загрузки файлов с RCE PoC: Измените поле Content-Type на image/png и сигнатуру файла на GIF87a...

Ashwesker-CVE-2026-21509

🛡️ CVE-2026-21509 — Microsoft Office Zero-Day Status: Actively exploited → Emergency patch released Severity: 🔴 High Risk Type: Security Feature Bypass 🔍 What is it? CVE-2026-21509 is a serious vulnerability in Microsoft Office that allows attackers to bypass built-in security protections by...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE Full unauthenticated RCE chain on n8n: 1. CVE-2026-21858 - Content-Type confusion → Arbitrary File Read 2. Read config + database → forge admin JWT 3. CVE-2025-68613 -...

ghost-cve-2026-26980

CVE-2026-26980 — Ghost CMS Content API SQL Injection Lab Unauthenticated blind SQL injection in Ghost CMS via the Content API's slug filter ordering mechanism, allowing arbitrary database reads from any Ghost instance without credentials. | ---|--- CVE| CVE-2026-26980 Advisory| GHSA-w52v-v783-gw9...

Ni8mare

🔒 Ni8mare Scanner Ethical Security Scanner for CVE-2026-21858 Ni8mare Vulnerability "Knowledge is power, but only if shared responsibly." Comprehensive vulnerability detection tool for n8n workflow automation instances. Detects the critical CVE-2026-21858 vulnerability CVSS 10.0 without performin...

CVE-2026-6182-SQLI-auth

SQL Injection Authentication Bypass - Simple Content Management System PHP Description A SQL Injection vulnerability exists in the admin login page of Simple Content Management System PHP. The user parameter is not sanitized before being passed to the SQL query, allowing an unauthenticated attack...

CVE-2026-6184-stored-XSS

Stored XSS in News Title - Simple Content Management System PHP Description A Stored Cross-Site Scripting XSS vulnerability exists in Simple Content Management System PHP. The News Title field in the admin panel does not sanitize user input before storing it in the database and reflecting it on t...

CVE-2026-21833

HCL AION is affected by a vulnerability in which the Content-Security-Policy CSP HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting XSS by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header...

CVE-2026-33917_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-33917 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...

EUVD-2026-90966

HCL AION is affected by a vulnerability in which the Content-Security-Policy CSP HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting XSS by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header...

CVE-2026-21833

HCL AION is affected by a vulnerability due to a missing Content-Security-Policy (CSP) HTTP response header. The absence of this header reduces the effectiveness of browser-based security controls, which are designed to prevent attacks like Cross-Site Scripting (XSS) by restricting the sources of...

CVE-2026-21833 HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)

HCL AION is affected by a vulnerability in which the Content-Security-Policy CSP HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting XSS by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header...

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

ImpactWho is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hostsAttack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it...

MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

Summarymcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRAPROJECTSFILTER and CONFLUENCESPACESFILTER environment variables, which the README documents as the...

GHSA-9CQF-HHRQ-7V45 SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit 9b8e8956f on 2026-07-27 and is present on the current development head. No released stable version is affected. Summary /api/av/getAttributeViewSearchTarget is registered with...

CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension

CVE-2026-22016 – IPFS CID Spoofing via Multihash Length Extension Program Code Python ipfscidspoof.py - Generates a CID with a different multihash length import multihash, cid Attacker creates a file whose hash, when truncated, matches a different file's prefix originalcontent = b"hello"...

CVE-2020-6519

This was originally published on PerimeterX company's official Github through my work Github account. Eventhough this is my work - all rights and legal concerns belong to PerimeterX company. Chromium 83 Zero Day Full CSP Bypass Cross Platforms CVE-2020-6519 Exploit DB Technical Article POC as...

changedetection.io

Автоматическое обнаружение изменений на веб-сайтах — мониторинг изменений веб-страниц в реальном времени Отслеживайте обновления веб-сайтов — получайте уведомления через Discord, Email, Slack, Telegram, Webhook и многие другие сервисы. Обнаруживайте изменения содержимого веб-страниц и получайте...