FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

ZyXel USG - Hardcoded Credentials

A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. id: CVE-2020-29583 info: name: ZyXel USG - Hardcoded Credentials autho...

Cisco IOS XE WLC - Arbitrary File Upload

A vulnerability in the Out-of-Band Access Point AP Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web...

authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

Zerologon_CVE-2020-1472

Zerologon CVE-2020-1472 This script is made for bulk checking your domain controllers for the Zerologon vulnerability. Note Zerologon vulnerabilities are dangerous for your domain controller, dont use the exploit on production servers. Arguments --ip Ip address for check on CVE-2020-1472 --file...

CVE-2026-128031

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...

EUVD-2026-125071

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...

CVE-2026-128031

The OpenMage magento-lts platform is vulnerable to an incorrect authorization issue in versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 . The root cause is that admin controllers' _isAllowed() checks fall back to, or exclusively check, parent ACL resources instead of enforcing specifi...

CVE-2021-1675-PrintNightmare-Analysis

Vulnerability Research: Local Privilege Escalation and RCE via Windows Print Spooler PrintNightmare / CVE-2021-1675 The repository contains a detailed technical report write-up and an analysis of the exploit concept for a critical vulnerability in the Windows Print Spooler service, which allows a...

adfly

adfly active directory query tool using LDAP Protocol , helps red teamer / penetration testers to validate users credentials , retrieve information about AD users , AD groups AD fly is Tool uses LDAP Protocol for users authentication access and queries of information ,since AD fly uses LDAP for...

nginx-cve-2026-42945

CVE-2026-42945 NGINX Rift — defensive scanner Organizations running NGINX Open Source , NGINX Plus , or NGINX-based ingress/controllers should verify whether they are affected by CVE-2026-42945 and patch or reconfigure before exploitation attempts hit production edges. This repository provides a...

zerologon

zerologon zerologon script to exploit CVE-2020-1472 CVSS 10/10 Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. https://github.com/risksense/zerologon To exploit,...

zerologon

zerologon Check for events that indicate non compatible devices - CVE-2020-1472 EventID 5827 EventID 5828 EventID 5829 EventID 5830 EventID 5831 In August Microsoft patched CVE-2020-1472. With that patch theres a waiting period until 9th of february 2021 where unsecure connections will be accepte...

CVE-2026-126071

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...

UBUNTU-CVE-2026-126071

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...

Set-ZerologonMitigation

Set-ZerologonMitigation Protect your domain controllers against Zerologon CVE-2020-1472. Usage After installing the August 2020 security update or a later cumulative version, just run the script on each of your domain controllers. .\Set-ZerologonMitigation.ps1 For help, run Get-Help: Get-Help...

CVE-2026-126071

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...

CVE-2026-126071

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...

EUVD-2026-122995

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...

CVE-2026-126071

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...