CVE-2026-105290 feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

EUVD-2026-92400

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-59788

A Stored XSS vulnerability exists in the email media type OAuth form because the application passes the Authorization endpoint value to window.open() without validating the URL scheme. This allows for the execution of a javascript: URL in the browser. An attacker can deliver a crafted media type ...

CVE-2026-105288

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirecturl leads to cross site scripting. The atta...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

EUVD-2026-92393

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289

The feelec-yishu feelcrm-os version 1.0.0 is vulnerable to a Cross-Site Scripting (XSS) flaw within the Create Customer Endpoint component. The root cause is the use of the htmlspecialchars_decode function in the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php. An attacker can initiate...

CVE-2026-105288 feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirecturl leads to cross site scripting. The atta...

EUVD-2026-92392

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirecturl leads to cross site scripting. The atta...

CVE-2026-105288

The feelec-yishu feelcrm-os 1.0.0 software contains a vulnerability within the Crm Endpoint component. Specifically, the IndexController::index function in the file App/ThinkPHP/Common/functions.php is susceptible to cross-site scripting (XSS) due to the improper handling of the redirect_url argu...

watchTowr-vs-Progress-ShareFile-CVE-2026-2699

CVE-2026-2699 Progress ShareFile Authentication Bypass Progress ShareFile Authentication Bypass Detection Artifact Generator Tool Description This Detection Artifact Generator verifies if Progress ShareFile instance is vulnerable to CVE-2026-2699 authentication bypass. Detection Artifact Generato...

CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105287

A SQL injection vulnerability exists in feelec-yishu feelcrm-os 1.0.0 within the getMemberByGroups endpoint. The flaw is caused by the manipulation of the groups[] argument in an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php . This vulnerability can be ex...

poc-2025-9074

CVE-2025-9074 | Docker API CVE-2025-9074 PoC Proof-Of-Concept A sophisticated exploitation framework for CVE-2025-9074, targeting unauthenticated Docker API endpoints with an integrated interactive command shell. Overview This tool automates the exploitation of exposed Docker API instances withou...

CVE-2018-7600

CVE-2018-7600 Drupalgeddon2 Exploit – Python3 DISCLAIMER: This project is for educational and authorized penetration testing purposes only. Do NOT use this code on systems you do not own or have explicit written permission to test. Unauthorized use is illegal and punishable by law. The author...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2025-6440

CVE-2025-6440 — WordPress WooCommerce Dynamic Pricing & Discounts Plugin Overview This repository contains a Python proof-of-concept PoC script for testing an unauthenticated file upload vulnerability affecting the WordPress WooCommerce Dynamic Pricing & Discounts plugin. ⚠️ This project is...

CVE-2026-105263

Shaarli versions up to 0.16.3 are vulnerable to a server-side request forgery (SSRF) flaw in the Admin Metadata Endpoint . The root cause is located in the MetadataController function within the file application/front/controller/admin/MetadataController.php, where a manipulation of the url argume...

CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...