354184 matches found
SUSE SLES16 Security Update : zstd-jni (SUSE-SU-2026:23868-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23868-1 advisory. - CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read bsc1279953. - CVE-2026-87824: denial of Servi...
Prompt-Injection-in-the-Wild
Prompt Injection in the Wild A tracker of publicly reported prompt-injection techniques from roughly the last two years, maintained by Rachel James cybershujin. Each technique is broken down into the three elements of a prompt injection: 1. Delivery method โ how the injected instructions reach th...
CVE-2026-90817
CVE-2026-90817 โ REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| โฅ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...
CVE-2026-41729
CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC This repository is a minimal reproduction PoC for CVE-2026-41729, as disclosed in the official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-41729/ Official title: Spring Data REST SpEL...
CVE-2025-65482-XXE-
CVE-2025-65482 XXE XML External Entity Injection XXE in XDocReport Bug Definition XML External Entity Injection Vulnerability Overview XML External Entity Injection XXE is a vulnerability in the processing of XML formatted data, where a user injects XML data that references an external file or...
CVE-2026-78582
Kibana is vulnerable to a Missing Authorization (CWE-862) flaw that allows an authenticated user with Synthetics privileges in a single space to permanently delete Synthetics monitors shared in other spaces where they lack access. If a monitor is associated with a private location, the operation ...
EUVD-2026-87794
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
CVE-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...
CVE-2026-72662
Kibana versions 8.x (8.0.0 to 8.19.21) and 9.x (9.4.0 to 9.4.5) are vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639). This flaw allows an authenticated user with Timeline feature privileges within a Kibana space to bypass Access Control Lists (ACLs) to enumerate, read, ...
CVE-2025-5287
CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...
CVE-2022-26134
ใ๐ฅใCVE-2022-26134 Description In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17...
CVE-2021-29447
WAV iXML XXE Exploit Generator Generates malicious WAV files that exploit XXE vulnerabilities in WordPress plugins parsing iXML metadata chunks e.g., BookingPress โ Target โ โโโโโโโโโโโโ โโโโโโโโโโโโ โฒ โ โ โ 2. Parse XML โ โ โ 3. GET /xxe.dtd โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ โ 4. GET...
CVE-2020-5248
CVE-2020-5248 POC Environment Setup and Test Test Method Environment Setup vim docker/nginx/default.conf servername docker host ip ; -change mysqlserver: mysql id: root pw: root Run cd docker/app/ tar -xvf /docker/app/glpi-9.4.5.tgz chmod -R 777 glpi docker-compose up -d Access glpi at...
CVE-2025-63943
CVE-2025-63943 โ SQL Injection in Grocery Store Management System 1.0 Overview A high-severity SQL Injection vulnerability was identified in the searchproducts.php component of Grocery Store Management System 1.0 , a PHP/MySQL-based web application created by anirudhkannan. The issue arises from...
cve-2025-55182
CVE-2025-55182 aka React2Shell Setup test enviornment kiot :: /react2shell ยป docker compose build --no-cache kiot :: /react2shell ยป docker compose up POC Payload 1. RCE with response in body POST / HTTP/1.1 Host: localhost:3000 Next-Action: whatever Content-Type: multipart/form-data;...
CVE-2024-56429
CVE-2024-56429 Access to the local database of the iLabClient Extract database password The iLabClient uses an Apache Derby database to store the locally required data. To ensure the encryption, a bootPassword is used for the creation, which can be extracted from the source code the extracted cod...
CVE-2025-8088-Exploit
CVE-2025-8088 WinRAR Exploit ๐ A proof-of-concept exploit for WinRAR vulnerability CVE-2025-8088 affecting versions 7.12 and lower. This tool creates a malicious RAR archive that embeds payloads in Alternate Data Streams ADS with path traversal, potentially leading to arbitrary code execution. Th...
SUSE CVE-2026-57178
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...
CVE-2022-42889
CVE-2022-42889-POC A simple demo application that shows how to exploit the CVE-2022-42889 vulnerability. Utilizes OOB Out of Band services to demonstrate dns and url prefixes. JavaDocs for commons-text interpolation commons-text JavaDocs Example interpolations script:javascript...