CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

EUVD-2026-92917

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - version 2020.7 An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcar...

CVE-2018-9995_dvr_credentials

Tool show DVR Credentiales Exploit Title: "Gets DVR Credentials" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Exploit Author: Fernandez Ezequiel twitter:@capitanalfa Exploit: $ curl...

Spring-Cloud-Gateway-CVE-2022-22947

Spring-Cloud-Gateway-CVE-2022-22947 Security advisory for the remote code execution vulnerability in Spring Cloud Gateway. This vulnerability occurs when the Gateway Actuator endpoint is enabled and exposed in Spring Cloud Gateway, making applications using Spring Cloud Gateway susceptible to cod...

watchTowr-vs-Splunk-CVE-2026-20253

CVE-2026-20253 Splunk Pre-Auth RCE Splunk Pre-Auth RCE 1day Detection Artifact Generator Tool Detection in Action Detection Artifact Generator attempts to access the /v1/postgres/recovery/backup endpoint of PostgreSQL Sidecar Service to verify if it is accessible or not: 400 response - probably...

CVE-2023-35078

CVE-2023-35078 shodan dorks You can use the following shodan dorks to find public targets. http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs You can use the following to transform data from shodan API to format suitable for the checking script: jq -cr 'select.http.favicon.hash ==...

exposecheck

EXPOSECHECK Only run against servers you own or are authorized to test. Scope: a passing result means only that this narrow check found an authentication challenge and a Langflow version at or above the patched threshold for CVE-2025-3248. It is not a general security, reputation, configuration, ...

EUVD-2026-92841

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqliquery of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql...

EUVD-2026-92840

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file gettown.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidv...

graphicator

Graphicator Graphicator 是一个 GraphQL "抓取器" / 提取器。该工具会遍历目标 GraphQL 端点返回的内省文档，然后重新构建内部形式的 schema，以便重新创建支持的查询。当这些查询创建完成后，工具会使用它们向端点发送请求，并将返回的响应保存到文件中。 错误的响应不会被保存。默认情况下，工具会缓存正确的响应以及错误信息，因此重新运行工具时不会重复执行相同的查询。 请明智地使用它，并且仅在你拥有权限的目标上进行操作。 我们希望该工具能帮助你作为渗透测试人员自动化自己的测试，同时也能推动那些尚未进行 GraphQL 测试的人开始行动。 了解如何对...

CVE-2026-105754

A flaw was found in vLLM. The scale-out inference service fails to properly validate caller-supplied multimodal parameters, such as image geometry and cache identifiers, against the active model's configuration. An authenticated remote attacker can exploit this vulnerability by submitting crafted...

PT-2026-106719

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password resul...

PT-2026-106728

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack m...

PT-2026-106712

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The atta...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenStack Aodh and Watcher vulnerability (USN-8870-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8870-1 advisory. Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the...

Linux Distros Unpatched Vulnerability : CVE-2026-105263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file...

CVE-2025-59528

Version française CVE-2025-59528 Prueba de Concepto PoC mínimo centrado en la validación técnica de la vulnerabilidad en un entorno autorizado. Requisitos previos Debe tener una cuenta de usuario en el panel de Flowise objetivo. Debe tener una clave de API válida vinculada a esa cuenta. Debe...

CVE-2024-7124

CVE-2024-7124 Reflected XSS in DInGO dLibra from 6.0 = 6.3.20 Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting XSS. An attacker might trick somebody in...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...