CVE-2026-85307

KP Agent Ready is a WordPress plugin developed by Kevin Pirnie. Versions prior to 1.2.08 are affected by an Insertion of Sensitive Information Into Sent Data vulnerability that allows an unauthenticated remote attacker to retrieve embedded sensitive data. The CVSS v3.1 score is 5.3 (Medium) with ...

WordPress KP Agent Ready plugin <= 1.1.99 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin KP Agent Ready versions = 1.1.99...

react

从 React 内部转储数据 这个工具是一个为 Tampermonkey 编写的快速而粗糙的用户脚本，它会深入任何 React 页面若干层，并搜索用户提供的一个或多个短语。 该工具可以让你轻松地在 DOM 中找到 React 附加大量 JSON 数据的位置。 手动查找这些位置可能非常耗时，因为数据的存储和传递方式在很大程度上取决于开发者、React 的版本以及特定网站的复杂性。 这个用户脚本旨在让这一过程变得容易得多。 下面是该脚本实际使用时的视频。 关于这项工作如何以及为何进行的更多背景信息，请参阅本仓库中其他位置的同名教程。 安装 从本仓库复制用户脚本，并按照 Tampermonke...

django-cve-2025-64459

Django CVE-2025-64459 This application demonstrates CVE-2025-64459 affecting multiple Django versions. This vulnerability has been patched in newer releases of Django. SQL Injection SQL Injection is when user-provided input is treated as part of a SQL query, allowing an attacker to change how the...

CVE-2026-35678

漏洞研究报告：All Eduplus 学生 ERP 不安全的直接对象引用（IDOR） 研究人员：Vinay Sharma 1. 执行摘要 本报告详细介绍了在 Eduplus 学生 ERP 平台中发现的一个高严重性安全漏洞，具体位于学生学习者门户（learnerapi.pceterp.in）中。该应用程序在考试表单提交端点上存在通用不安全的直接对象引用（IDOR）漏洞，允许任何已认证用户（学生）通过操纵表单标识符来检索任何其他学生的敏感个人和财务数据。 该漏洞允许大规模收集学生记录数据，包括个人身份信息（PII）和详细的财务交易审计跟踪。 2. 漏洞详情 目标主机：...

CVE-2021-43798-poc

CVE-2021-43798-poc Grafana8.x 任意文件读取 python CVE-2021-43798-poc.py http://152.136.149.237:3000 /etc/passwd...

CVE-2024-55457-PoC

CVE-2024-55457-PoC MasterSAM Star Gate v11 存在目录遍历漏洞，可通过端点 /adama/adama/downloadService 进行利用。攻击者可通过操纵 file 参数访问服务器上的任意文件，可能导致敏感信息泄露。 在“故障排除 - 下载日志”功能中负责下载日志的 API 中，应用程序未对通过 file 参数指定的文件执行路径验证。此外，用户无需身份验证即可调用此 API。 GET /adama/adama/downloadService?type=&file= HTTP/1.1...

CVE-2026-85093 Cheshire Cat AI Memory Collection Endpoint Information Disclosure

Cheshire Cat AI's GET /memory/collections/collectionid/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...

CVE-2026-85093 Cheshire Cat AI Memory Collection Endpoint Information Disclosure

Cheshire Cat AI's GET /memory/collections/collectionid/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...

CVE-2023-49339

CVE-2023-49339 安全漏洞报告：Ellucian Banner 系统 简介 本文档概述了在 Ellucian Banner 系统中发现的一个严重安全漏洞，特别是在 9.17 及更早版本中。该漏洞已在沙特阿拉伯多所大学使用的系统中被发现，可能暴露敏感的学生数据。 漏洞详情 类型： 不安全的直接对象引用（IDOR） 受影响的端点： /StudentSelfService/ssb/studentCard/retrieveData 涉及的参数： bannerId 影响： 未经授权暴露敏感的学生数据，包括个人标识符、学业记录和联系信息。 复现步骤 1. 使用合法用户凭据登录 Banne...

CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – Configuración incorrecta de CORS que conduce a la exposición de datos autenticados 📌 Referencia de aviso ID de CVE: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 Proveedor: karnop Producto: realtime-collaboration-platform Gravedad: ALTA CVSS 7.4 Vector:...

PT-2026-85206

A critical WHMCS security update fixes CVE-2026-67399 and CVE-2026-67398. Apply the patch now to prevent remote code execution and data leaks. WHMCS CyberSecurity CVE202667399 CVE202667398 InfoSec https://t.co/LuCYwv3icN https://t.co/BNvTvGIUBc...

CVE-2026-75137

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75135

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-75137

UpSignOn for Windows versions before 7.19.0 are affected by a sensitive data exposure vulnerability in process memory after the application has been locked. A local attacker with the PROCESS_VM_READ permission can read the memory space of UpSignOn.exe and extract cleartext vault data, including e...

EUVD-2026-70262

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75137 UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75135 UpSignOn < 7.19.0 Sensitive Key Retention in Memory

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

EUVD-2026-70260

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2024-7956

CVE-2024-7956 is an Incorrect Authorization (CWE-863) vulnerability in Rockwell Automation DataMosaix Private Cloud , versions 7.07 and prior . A threat actor with basic user privileges can gain unauthorized access to other users' projects and modify or delete them. The CVSS v3.1 base score is 8....