388717 matches found
PT-2026-109856
Name of the Vulnerable Software and Affected Versions Kicker versions prior to 2.2.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...
PT-2026-109875
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the exportXls handler within the AiragExtDataController. This issue allows any authenticated user, including those with low privileges, to export AI evaluator data. ...
PT-2026-109824
Name of the Vulnerable Software and Affected Versions Equadio versions prior to 1.1.5 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...
PT-2026-109784
Name of the Vulnerable Software and Affected Versions CleanSkin versions 1.5.0 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...
PT-2026-109901
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysDepartRoleController. The issue stems from the absence of Shiro permission annotations, which are used to enforce access control. Thi...
PT-2026-109900
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users to permanently delete data dictionaries. Low-privileged attackers can send DELETE requests to the '/sys/dict/deletePhysic/id' endpoint, which trigge...
PT-2026-109825
Name of the Vulnerable Software and Affected Versions WineShop versions 3.20 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...
PT-2026-109805
Name of the Vulnerable Software and Affected Versions Contact Form 7 – Dynamic Text Extension versions prior to 5.0.8 Description An issue exists that allows unauthenticated users to cause sensitive data exposure. Recommendations Update to a version newer than 5.0.7...
PT-2026-109572
Name of the Vulnerable Software and Affected Versions Gutentype versions prior to 2.1.13 Description Deserialization of untrusted data in the Gutentype plugin allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application to execute arbitrary cod...
PT-2026-109577
Name of the Vulnerable Software and Affected Versions Smart Casa versions prior to 1.0.13 Description ThemeREX Group Smart Casa is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an...
PT-2026-109578
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4...
PT-2026-109781
Name of the Vulnerable Software and Affected Versions Booster for WooCommerce versions prior to 8.4.1 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the...
CVE-2026-108579: Improper Neutralization of Formula Elements in a CSV File
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...
CVE-2026-78531: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Jacqueline = 2.22 versions...
CVE-2026-14877: Improper Neutralization of Input During Web Page Generation
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-109859
Name of the Vulnerable Software and Affected Versions Jacqueline versions 2.22 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...
pymap
pymap — SQL injection discovery & exploitation toolkit Two co...
spring-break_cve-2017-8046
spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...
mapsdumper
▒█▀▄▀█ ░█▀▀█ ▒█▀▀█ ▒█▀▀▀█ ▒█▀▀▄ ▒█░▒█ ▒█▀▄▀█ ▒█▀▀█ ▒█▀▀▀ ▒█▀▀█ ▒█▒█▒█ ▒█▄▄█ ▒█▄▄█ ░▀▀▀▄▄ ▒█░▒█ ▒█░▒█ ▒█▒█▒█ ▒█▄▄█ ▒█▀▀▀ ▒█▄▄▀ ▒█░░▒█ ▒█░▒█ ▒█░░░ ▒█▄▄▄█ ▒█▄▄▀ ░▀▄▄▀ ▒█░░▒█ ▒█░░░ ▒█▄▄▄ ▒█░▒█ by: @Tegal1337 MAPSDUMPER Demo • Installazione • Funzionalità • Crediti Uno strumento per estrarre i dettagl...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Cross-Site Scripting.
Summary ip-address is used by IBM Storage Fusion Data Foundation, which could cause Cross-Site Scripting. CVE-2026-42338. Vulnerability Details CVEID:CVE-2026-42338 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1,...