GHSA-7649-WM97-W3J3 Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

demiguise

Demiguise - HTA暗号化ツール NCC Group Plc によりオープンソースとして公開 - http://www.nccgroup.trust/ 開発者: Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise AGPLのもとで公開。詳細はLICENSEを参照。 これは何をするものか？ このプロジェクトの目的は、 暗号化されたHTAファイルを含む .html...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF003 for September 2026

Summary IBM Content Cortex CCx 26.0.0-IF003 addresses CVEs across components including CPE, GraphQL, External share and Content Based Search Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without...

DRUPAL-CONTRIB-2026-204

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...

CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 プロジェクトアドレス： 準備作業： バックエンドにログイン - cookieを取得 脆弱性URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= 脆弱性パラメータ: keyword ペイロード: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/ /select+1=%27 インジェクションが成功すると遅延が1秒以上になり、そうでなければ遅延はありません。...

CVE-2023-27163-POC

CVE-2023-27163 Request-Baskets 向け SSRF の PoC CVE-2023-27163 - entr0pie のこのコードを基にしています。 この PoC は、別の Web サービス（ローカルまたはその他）のコンテンツをファジングし、見つかったファイルの内容を返すように拡張されています。 使い方 python3 CVE-2023-27163.py http://: -t http://: -w...

BIT-JOOMLA-2026-90916 Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260906 - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents...

AOSP-ExploitUserDictionary

AOSP-ExploitUserDictionary AOSP UserDictionary Content Provider CVE-2018-9375 の PoC エクスプロイト セキュリティアドバイザリ https://ioactive.com/wp-content/uploads/2018/08/IOActive-Security-Advisory-AOSP-UserDictionaryProvider-v1.0.pdf 詳細情報...

CVE-2024-48652

CVE-2024-48652 camaleon-cms v.2.7.5 におけるクロスサイトスクリプティングの脆弱性。リモートの攻撃者がコンテンツグループ名フィールドを介して任意のコードを実行可能。 再現手順: 1. URL http://127.0.0.1/admin/dashboard にアクセスする。 2. 管理者認証情報でログインする。 3. 「設定」セクションに移動する。 4. 「コンテンツグループ」をクリックする。 5. コンテンツグループの「編集」オプションを選択する。 6. 「名前」フィールドに、以下の XSS ペイロードを入力する: " 7. 変更を保存する。 8...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin versions before 1.10.2 (specifically versions 1.4.4 through 1.10.1) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to validate the URL scheme of a request-supplied value, which is then reflected into a link on an admi...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

EUVD-2026-94188

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

WordPress Academy LMS plugin < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure vulnerability

Subscriber+ Arbitrary Lesson Content Disclosure vulnerability discovered by Morato Antoine in WordPress Plugin Academy LMS versions 4.0.0...

CVE-2026-106494

A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...