36606 matches found
PT-2026-87121
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...
PT-2026-87118
Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c Description An authorization bypass exists where a session cookie named key with the value value overrides the key parameter within the $ REQUEST array in the 'saveLive.php' endpoint and related...
CVE-2026-86721: Improper Authentication
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...
NewStart CGSL MAIN 7.02 : curl Vulnerability (NS-SA-2026-0092)
The remote NewStart CGSL host, running version MAIN 7.02, has curl packages installed that are affected by a vulnerability: - 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same hostname, but using clear text...
Fedora 44 : nsd (2026-bf1539678e)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf1539678e advisory. BUG FIXES: Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networ...
Fedora 43 : nsd (2026-3ff003d397)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ff003d397 advisory. BUG FIXES: Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networ...
PT-2026-88169
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...
EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3253)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...
EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3328)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...
misfortune-cookie
CVE-2014-9222 "Misfortune Cookie" PoC suite Stack overflow in...
Updated apache-mod_auth_openidc packages fix a security vulnerability
Out-of-bounds read and write in state cookie parsing. CVE-2026-54789...
MGASA-2026-0381 Updated apache-mod_auth_openidc packages fix a security vulnerability
Out-of-bounds read and write in state cookie parsing. CVE-2026-54789...
Exploit for CVE-2026-36392
CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Su...
CVE-2026-86306
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead...
CVE-2026-86306 light0011 cms Cookie Helper UserModel.class.php improper authentication
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead...
EUVD-2026-72397
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead...
CVE-2026-86306
light0011 CMS , a PHP-based content management system hosted on GitHub, is affected by an improper authentication flaw in the Cookie Helper component. The vulnerability resides in the file App/Home/Model/UserModel.class.php and is triggered by manipulating the Username argument. Because the flaw ...
CVE-2026-86306 light0011 cms Cookie Helper UserModel.class.php improper authentication
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead...
CVE-2026-86306 light0011 cms Cookie Helper UserModel.class.php improper authentication
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead...
WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability
Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability discovered by Pham Duc Anh in WordPress Plugin iubenda versions = 3.13.4...