EUVD-2026-90292

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could...

CVE-2025-11174

CVE-2025-11174: Document Library Lite WordPress 플러그인의 인증되지 않은 정보 노출 키워드: CVE-2025-11174, Document Library Lite 취약점, 정보 노출, WordPress 보안, 인증되지 않은 AJAX 악용, WordPress 플러그인 취약점, CWE-862, WordPress 문서 플러그인 보안, 인증 우회, WordPress CVE 2025 목차 개요 취약점 세부 정보 기술 분석 공격 경로 개념 증명 해결 가이드 탐지 CVSS 점수 참고 자료 크레딧 보안 연...

Malware-Analysis-Follina-CVE-2022-30190

Malware-Analysis-Follina-CVE-2022-30190 정적 악성코드 분석 – Follina 익스플로잇CVE-2022-30190 악성 Microsoft Word 문서 조사 Kali Linux에서 실제 악성코드 분석 세션 중에 sample.doc이라는 의심스러운 파일을 발견했습니다. 실행하지 않고 그 특성과 동작을 이해하기 위해 구조화된 정적 분석을 수행하기로 결정했습니다. 이 문서는 제가 수행한 정확한 단계, 관찰한 내용, 그리고 도달한 결론을 설명합니다. 모든 작업은 Kali Linux가 실행되는 격리된...

CVE-2026-88920

A flaw was found in Apache WSS4J. This vulnerability in the Document Object Model DOM security processor allows an unauthenticated remote attacker to bypass authentication and forge authenticated Simple Object Access Protocol SOAP messages. An attacker can exploit this issue by submitting a...

CVE-2025-57298

Kotaemon의 안전하지 않은 Markdown 렌더링을 통한 저장형 XSS 요약 Kotaemon은 PDF, Word, Excel 파일과 같은 업로드된 문서를 질의할 수 있는 웹 인터페이스를 제공하는 오픈소스 RAGRetrieval-Augmented Generation 기반 문서 QA 시스템입니다. Kotaemon의 문서 렌더링 파이프라인에는 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 사용자 제어 콘텐츠는 LLM에 의해 처리되고, 적절한 살균 없이 markdown-to-HTML 변환 후 웹 인터페이스에서 렌더링되므...

cve-2025-54988-VulnTikaProject

Apache Tika 취약점 테스트 프로젝트 문서 처리 및 텍스트 추출을 위해 Apache Tika 3.2.1을 사용하는 Spring Boot 애플리케이션입니다. 사전 요구 사항 Docker 필요 사용법 ./start-app.sh or docker compose up -d CVE 실행 추출을 위해 악성 PDFhttps://github.com/mgthuramoemyint/POC-CVE-2025-54988를 엔드포인트에 업로드합니다. curl -X POST -F "[email protected]"...

CentOS Linux 8 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS-STREAM8:CLSA-2026:1777540724)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777540724 advisory. - Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a...

CVE-2026-102125: Improper Isolation or Compartmentalization

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could...

AlmaLinux 9.2 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1745272309)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745272309 advisory. - An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur via a crafted...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2025:1758796854)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1758796854 advisory. - Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-base...

CVE-2026-95338

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code within the browser's sandbox by convincing a user to open a specially crafted PDF document. This issue is caused by a use-after-free vulnerability in the PDFium component, where memory is improperly accessed after ...

GHSA-GR2M-V5GQ-V685 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Impact Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes. Apps are only affected i...

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Impact Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes. Apps are only affected i...

OnlyOffice-path-traversal

ONLYOFFICE Path Traversal 익스플로잇 CVE-2023-46988 📌 개요 이 스크립트는 ONLYOFFICE Document Server 의 경로 탐색Path Traversal 취약점CVE-2023-46988을 악용하여, 인증되지 않은 사용자가 서버에서 임의의 파일을 복사 할 수 있게 합니다. 이 취약점은 /example/editor 엔드포인트에 존재하며, fileExt 매개변수를 조작하여 민감한 시스템 및 구성 파일에 접근할 수 있습니다. ⚠️ 면책 조항 이 도구는 교육 및 승인된 보안 연구 목적으로만...

CVE-2026-102674 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a...

CVE-2026-88358

A flaw was found in simdjson. An attacker can cause a Denial of Service DoS by providing a specially crafted, truncated JSON document to an application using the library. During processing, the parser accesses memory beyond the input buffer, causing the application to crash unexpectedly...

CVE-2025-65640

CVE-2025-65640 1. 취약점 정보 CVE ID: CVE-2025-65640 현재 RESERVED 취약점 유형: 저장형 크로스 사이트 스크립팅XSS CVSSv3 점수: 6.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N 공급업체: Arket/Bluenext S.r.l. 제품: Globe Document Intelligence 영향을 받는 버전: 5.0.0.559 발견자: Vincenzo Emanuele Martone 2. 설명 Globe Document Intelligence 플랫폼버전...

CVE-2026-102244

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2021-41773h

CVE-2021-41773 Apache HTTP Server 2.4.49의 경로 탐색 및 파일 노출 취약점 CVE-2021-41773 정보 Apache HTTP Server 2.4.49의 경로 정규화 변경에서 결함이 발견되었습니다. 공격자는 경로 탐색 공격을 사용하여 URL을 예상 문서 루트document root 외부의 파일에 매핑할 수 있습니다. 문서 루트 외부의 파일이 "require all denied"로 보호되지 않으면 이러한 요청이 성공할 수 있습니다. 또한 이 결함은 CGI 스크립트와 같은 해석된 파일의 소스를 유...

EUVD-2026-88618

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...