discuz-ml-rce

discuz-ml-rce Affected systems and versions: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Vulnerability cause: The Discuz!ML system does not filter the language parameter content received by l in the cookie, leading to string concatenation, thereby executing PHP code. The cookie field will contain an...

Web-Penetration-Test

Web-Penetration-Test Exploiting WordPress vulnerabilities CVE-2025-34077, authentication bypass via cookie injection, and privilege escalation to root. Part of my Cybersecurity Specialization. Day 1: Hacking my First Website Lab Report: Exploiting the "BigWear" Server In this first session of my...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group Overview Field Value CVE ID CVE-2026-5513 Vulnerability Stored Cross-Site Scripting XSS...

CVE-2023-25292

CVE-2023-25292 Reflected Cross Site Scripting XSS in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GOLANGUAGE cookie Vulnerability Details Product: Group Office Application Version: 6.6.145 Vulnerability Type:...

MiracleLinux 8 : curl-7.61.1-34.el8_10.18 (AXSA:2026-2285:10)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2285:10 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized connection reuse due to a...

EUVD-2026-119420

Tornado before 6.6 does not validate the maxage argument of RequestHandler.setcookie also called by setsignedcookie, setsecurecookie, and clearcookie, allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as maxage, an attacker can embed...

CVE-2026-123319

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-123319

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-123319

In JetBrains Ktor versions before 3.6.1 , a vulnerability exists due to missing Domain attribute validation in client cookie storage. This flaw allows for cookie injection . Remediation is available in version 3.6.1 . No specific exploit details or in-the-wild exploitation information are provide...

EUVD-2026-118083

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-123319

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-123319: JetBrains Ktor: In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection...

CVE-2026-107229

A flaw was found in AsyncHttpClient. The library's cookie store incompletely validates domain attributes when processing HTTP cookies. A remote attacker controlling a server can exploit this vulnerability to store cookies that the client subsequently sends to unrelated domains. This allows...

curl: curl: Cookie injection via malicious HTTP server using super cookies

A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2026-119416

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2026_92368)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202692368 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized connection reuse due to a logica...

CVE-2026-119416

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...

CVE-2026-119416

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or...

RLSA-2026:92368 Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized...