Probo 0.222.2 - IDOR

Exploit Title: Probo 0.222.2 - IDOR Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/getprobo/probo Software Link: https://github.com/getprobo/probo Version: cross-tenant read. Advisory: GHSA-c74x-79w6-63jh. NOTE: PoC is a Go test using...

EUVD-2007-4613

Malware in sbrugna...

com.graphql-java:java-dataloader (>=1.0.2, <=2.0.0-alpha1) potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (4.0)

com.graphql-java:graphql-java MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:java-dataloader =1.0.2, =2.0.0-alpha1 Source cves: CVE-2024-40094 Source advisory:...

com.graphql-java:java-dataloader (>=1.0.2, <=2.0.0-alpha1) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (4.0)

com.graphql-java:graphql-java MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:java-dataloader =1.0.2, =2.0.0-alpha1 Source cves: CVE-2022-37734 Source advisory:...

PT-2021-16248

Name of the Vulnerable Software and Affected Versions: SEO Booster WordPress plugin versions prior to 3.8 Description: The issue allows for authenticated SQL injection via the "fn my ajaxified dataloader ajax" AJAX request. The $ REQUEST'order'0'dir' parameter is not properly escaped, leading to...

Information Disclosure

ansible is vulnerable to information disclosure. The Dataloader temporary files are not properly cleaned during the context and threads switching, allowing a local user to access the temporary files and obtain confidential information...

CVE-2019-11215

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during...

Race condition

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during...

CVE-2007-4631

The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames...

Code injection

The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames...

DEBIAN-CVE-2007-4631

The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames...

CVE-2007-4631

The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames...

CVE-2007-4631

The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames...

CVE-2007-4631

The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames...