engel (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-77528 via autobahn (0.13.0)

autobahn PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - engel =0.3.0, =0.3.1 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

engel (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-77528 via autobahn (0.13.0)

autobahn PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - engel =0.3.0, =0.3.1 Source cves: CVE-2026-77528 Source advisory: OSV:GHSA-HXP9-W8X3-P566...

Engel P-Adic Isogeny-Based Cryptography over Laurent Series: Foundations, Security, and an ESP32 Implementation

Securing the Internet of Things IoT against quantum attacks requires public-key cryptography that i remains compact and ii runs efficiently on microcontrollers, capabilities many post-quantum PQ schemes lack due to large keys and heavy arithmetic. We address both constraints simultaneously with, ...

CVE-2024-53779

Cross-Site Request Forgery CSRF vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Stored XSS.This issue affects Yahoo! WebPlayer: from n/a through = 2.0.6...

shop.engel.ch Cross Site Scripting vulnerability OBB-3352825

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

engel-jung.de Cross Site Scripting vulnerability OBB-3266257

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

engel-europe.nl Improper Access Control vulnerability OBB-2241383

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

engel-zimmermann.de Improper Access Control vulnerability OBB-2210334

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Engel & Völkers Technology GmbH: Grafana default username password authentication into the Grafana platform of the grafana.ev-cloud-platform.engelvoelkers.com

Summary: Default username password is working for the grafana.ev-cloud-platform.engelvoelkers.com. Steps To Reproduce: Login into the panel as username - █████████ password - █████ Attachment PoC video is attaached. Impact This can lead sensitive information about the server's analytics and other...

Engel & Völkers Technology GmbH: XSS reflected

Summary: Cookie input nbu2 was set to "alert9536" and the input is reflected inside a tag between single quotes. Steps To Reproduce: 1. go to https://www.engelvoelkers.com/en/search/ 1. change parameter nbu2 in Cookie to :- "alert9536" 1. now check the response alerting 9536 in popup window...

Engel & Völkers Technology GmbH: Debug information at the /sapi endpoint

Summary: Sending a GET request to www.engelvoelkers.com/sapi and the server responds with a 500 Internal Server Error which yields a stack trace. Steps To Reproduce: - Enter www.engelvoelkers.com/sapi into your web browser and you can see the stacktrace. https://bugpoc.com/pocbp-VPZDeo2Z I will...

Engel & Völkers Technology GmbH: Publicly accessible .SVN repository allows downloading entire source code

Summary of the Issue The researcher found a publicly accessible SVN repository at https://printshop.engelvoelkers.com/.svn/wc.db Steps to reproduce Go to https://printshop.engelvoelkers.com/.svn/wc.db Impact statement Information disclosure...

Engel & Völkers Technology GmbH: reflected xss in ██████

Summary: your subdomain : ██████ suffer from reflected xss bug that leads to execute javascript codes into browser Steps To Reproduce: add details for how we can reproduce the issue 1. visit : █████ 2. you will see popup and xss confirmed Supporting Material/References: █████ Impact An attacker c...

Engel & Völkers Technology GmbH: Information disclosure at https://printshop.engelvoelkers.com/packages/.bash_history

Hello! I found .bashhistory in the home directory and this file was accessible through the web screenshot in attachment. This file exposes sensitive information history commands, directories, software version that could help a malicious user to prepare more advanced attacks. POC:...

Engel & Völkers Technology GmbH: XSS reflected in https://tableau.engelvoelkers.com/

Summary: XSS reflected in https://tableau.engelvoelkers.com/ Steps To Reproduce: POC: https://tableau.engelvoelkers.com/en/embeddedAuthRedirect.html?auth=javascript:alertdocument.domain F848501 Impact XSS...

Engel & Völkers Technology GmbH: full path disclosure on world.engelvoelkers.com via error messages

Webserver in world.engelvoelkers.com discloses internal path in it's error message Via a browser: http://world.engelvoelkers.com/config/app.php http://world.engelvoelkers.com/connect.php Impact There is no direct impact, however this information can help an attacker identify other vulnerabilities...

Engel & Völkers Technology GmbH: [go3-stage.engelvoelkers.com] - Reflected XSS in /dGPS3/default.jsp

Summary: The application fails to sanitize user input in https://go3-stage.engelvoelkers.com/dGPS3/default.jsp and reflect the input directly in the HTTP response, allowing the hacker to exploit the vulnerable parameter and have malicious content executed in the victim's browser. Description: A...

Engel & Völkers Technology GmbH: [go3-intern.engelvoelkers.com] - Reflected XSS in /dGPS3/default.jsp

Summary: The application fails to sanitize user input in https://go3-intern.engelvoelkers.com/dGPS3/default.jsp and reflect the input directly in the HTTP response, allowing the hacker to exploit the vulnerable parameter and have malicious content executed in the victim's browser. Description: A...

Engel & Völkers Technology GmbH: Information Exposure at https://printshop.engelvoelkers.com/

Summary: There is an information exposure through some tmp, txt files that can allow an attacker to download some files from the application. Steps To Reproduce: + There are some files that exposed internal links from the application, inside of these files you can view some .xls that you can...

Engel & Völkers Technology GmbH: [www.go3.engelvoelkers.com] - Reflected XSS in /dGPS3/default.jsp

Summary: The application fails to sanitize user input in https://www.go3.engelvoelkers.com/dGPS3/default.jsp and reflect the input directly in the HTTP response, allowing the hacker to exploit the vulnerable parameter and have malicious content executed in the victim's browser. Description: A...