CVE-2026-17589 Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-19796

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lsd[displ][style] parameter in all versions up to and including 5.8.1 . The root cause is insufficient input sanitization and output escaping , allowi...

CVE-2026-19796 Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsddisplstyle' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible f...

EUVD-2026-68967

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsddisplstyle' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-19796 Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsddisplstyle' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible f...

Cve-2025-8088-WinRar-vulnerability

Cve-2025-8088 WinRAR Python tool that creates a malicious RAR file to exploit the CVE-2025-8088 vulnerability in WinRAR. The CVE-2025-8088 vulnerability allows exploitation of manipulated RAR files to cause path traversal and overwrite arbitrary files on the victim's system. This project is for...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Resources https://vulners.com/cve/CVE-2016-2098 Usage To use this...

CVE-2024-53677-POC

CVE-2024-53677 다소 오래된 취약점으로, Apache Struts에 영향을 주며 LFI 및 원격 실행으로 이어집니다. 이 취약점에 대한 자세한 정보는 이 훌륭한 블로그를 참조하세요. Apache Struts 경로 탐색 → RCE CVE-2024-53677 POC 사용법 이 CVE를 처음 접했을 때 제대로 구현한 좋은 소스를 찾지 못했기 때문에, 가능한 한 사용자 정의가 가능하도록 만드는 데 많은 시간을 투자했습니다. 대부분의 플래그에는 기본값이 있으므로 이러한 모든 플래그에 겁먹지 마세요. root@kitploit:...

CVE-2025-24893-PoC

CVE-2025-24893-PoC XWiki Unauthenticated RCE Exploit Affected XWiki Versions Versions 15.10.11 Versions 16.4.1 Versions 16.5.0RC1 Vulnerability Description Affected XWiki versions contain a Remote Code Execution vulnerability caused by unsafe Groovy expression handling in the SolrSearch macro...

ysoserial.net

안전하지 않은 .NET 객체 역직렬화를 악용하는 페이로드를 생성하기 위한 개념 증명 도구입니다. 설명 ysoserial.net은 일반적인 .NET 라이브러리에서 발견된 유틸리티 및 프로퍼티 지향 프로그래밍 "가젯 체인"의 모음으로, 적절한 조건에서 unsafe 객체 역직렬화를 수행하는 .NET 애플리케이션을 악용할 수 있습니다. 메인 드라이버 프로그램은 사용자가 지정한 명령을 가져와 사용자가 지정한 가젯 체인에 래핑한 후 이러한 객체를 stdout으로 직렬화합니다. 필요한 가젯이 클래스패스에 있는 응용 프로그램이 이 데이터를...

coolify-cve-2025-66209-66213

Coolify Security Advisories - CVE-2025-66209 through CVE-2025-66213 Reporter: 0xrakan Vendor: coollabsio/coolify Affected Versions: v4.0.0-beta.451 Fixed Version: v4.0.0-beta.451 Severity: Critical CVSS 9.4 Overview Five critical authenticated command injection vulnerabilities were discovered in...

CVE-2026-82731

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in ash-project ashtypescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in...

React2Shell_Hunter

React2Shell Hunter CVE-2025-55182 및 CVE-2025-66478을 위한 AWS 조직 차원 탐지 툴킷 ⚠️ 중요 면책 조항 - 사용 전 반드시 읽어주세요 이 툴킷은 프로덕션 AWS 환경에서 테스트되지 않았습니다. 인프라 제약으로 인해 이 프로젝트는 코드 리뷰, 정적 분석 및 문서 검증을 통해서만 개발 및 검증되었습니다. 실제 GuardDuty, WAF, EventBridge 또는 CloudTrail 서비스가 활성화된 라이브 AWS 환경에 배포되거나 테스트되지 않았습니다. 이것이 의미하는 바: 구성 요소|...

Updated varnish packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass. CVE-2026-34475 In Vinyl Cac...

MGASA-2026-0357 Updated varnish packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass. CVE-2026-34475 In Vinyl Cac...

CVE-2025-14174-analysis

CVE-2025-14174 분석: ANGLE Metal Staging Buffer Out-of-Bounds Write CVE-2025-14174에 대한 기술 분석 및 개념 증명 | ---|--- CVE| CVE-2025-14174 심각도| 높음 실제 공격에 사용됨| 예 - iOS 26 미만 대상 공격 영향을 받는 대상| iOS Safari, macOS Chrome/Chromium/Electron macOS Safari 제외 상태| ANGLE 커밋 95a32cb에서 패치됨 크레딧| Apple, Google Threat...

CVE-2026-82731 Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in ash-project ashtypescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in...

CVE-2026-82731 Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in ash-project ashtypescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in...

EEF-CVE-2026-82731 Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection

Summary URL Redirection to Untrusted Site 'Open Redirect' vulnerability in ash-project ash\typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders...

CVE-2026-82731 Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in ash-project ashtypescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in...