8869 matches found
CVE-2025-51867
CVE-2025-51867 Vulnerability description Deepfiction AI is an AI entertainment company with a mission to revolutionize personalized storytelling. Deepfiction AI provide a web application to create stories by chatting with LLM, which is vulnerable to Insecure Direct Object Reference IDOR in its ch...
CVE-2026-112777
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObje...
CVE-2021-42392-exploit-lab
⚠️ H2 Database RCE Exploit PoC CVE-2021-42392 This repository provides a minimal and controlled environment to test the H2 Database Remote Code Execution vulnerability CVE-2021-42392 using the CREATE ALIAS feature. Unlike many demonstrations, this exploit targets the H2 TCP service directly...
CVE_6387
This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...
CVE-2026-112777 Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObje...
CVE-2026-112777 Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObje...
CVE-2026-112777
Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 are vulnerable to a blocklist bypass in the Twig create() function. The root cause is that class-name checks are case-sensitive, whereas PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administ...
CLSA-2026-1792430034 TuxCare security update for create-react-router (1 CVE)
TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.9...
CLSA-2026-1792430033 TuxCare security update for create-react-router (1 CVE)
TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.8...
CLSA-2026-1792430030 TuxCare security update for create-react-router (3 CVEs)
TuxCare rebuilt create-react-router to address 3 CVEs. Fixed in 7.5.1-tuxcare.5...
CLSA-2026-1792430031 TuxCare security update for create-react-router (1 CVE)
TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.6...
cve-2024-3435
This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...
CVE-2026-111056
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...
CVE-2026-111056 FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...
EUVD-2026-104418
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...
CVE-2026-111056
The FOSSBilling open-source billing platform is vulnerable to unauthenticated client account enumeration in versions 0.1.0 through 0.8.7 . The issue exists in the POST /api/guest/client/create endpoint, where the Box Mod Client Api Guest::create method returns an unredacted error message when Cli...
CVE-2026-111056 FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...
CVE-2026-94231
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...
mariadb: mariadb: SQL injection via improper identifier quoting
A flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing SQL data. An authenticated, low-privileged attacker can...
mariadb: mariadb: SQL injection via improper identifier quoting
A flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing SQL data. An authenticated, low-privileged attacker can...