Malware in api-nebula

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in llm-nebula

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-49543

CVE-2023-49543 Book Store Management System v1.0 - Incorrect Access Control Description : Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating. Vulnerable Product Version : Book Store...

CVE-2023-34965

CVE-2023-34965 SSPanel UIM is a multi-purpose agency service sales management system specially designed for Shadowsocks / V2Ray / Trojan protocols. SSPanel-Uim version before 2023.3 does not restrict access to the /link/ interface,which can lead to a leak of user subscription information. Detail...

CVE-2026-66916

Password-Protected Category Bypass via JSON Format in JoomGallery JoomGallery ≤ 4.3.0-stable — Unauthenticated Attacker Bypasses Password Gate to Download Protected Images SUMMARY An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is...

CVE-2025-29705

CVE-2025-29705 CVE-2025-29705 Introduction code-gen: A code generation tool that allows custom templates to generate different code, supporting MySQL, Oracle, SQL Server, PostgreSQL https://gitee.com/durcframework/code-gen This project has no access control, allowing anyone to freely access such...

CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the...

CVE-2024-37742

CVE-2024-37742: Clipboard Exploit in SEB ≤ 3.5.0 Windows This repository contains a proof-of-concept PoC for exploiting CVE-2024-37742, a vulnerability in Safe Exam Browser SEB ≤ 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode and the...

cve-2016-7190

Overview CVE-2016-7190 0 is a heap overflow in the Array.map function of ChakraCore that allows to overwrite adjacent memory. The main idea to gain arbitrary read-write access is to first allocate a number of consecutive JavaScript integer Arrays. and to exploit the overflow to manipulate the siz...

CVE-2020-25747

CVE-2020-25747 Suggested description The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras firmware versions v342, v339 can allow a remote attacker to gain access to RTSP and ONFIV services without authentication. Thus, the attacker can watch live streams from the camera, rotate the...

CVE-2026-109177

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109165

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-108889

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access...

Malware in @pinecone-experience/messages

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in risk-detection

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in unified-platform

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-109177 MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

EUVD-2026-97381

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109177

MoguBlog versions up to and including 6.2 are vulnerable to a broken access control flaw. The issue stems from a lack of admin_uid checks when processing specific requests, allowing authenticated administrators to move or rename network-disk files belonging to other administrators. By sending cra...

CVE-2026-109175 MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...