CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 5.29.5 . The root cause is insufficient escaping of the user-supplied orderby parameter and a lack of sufficient preparation on the existing SQL query. This allows ...

usbrip

usbrip heredado de "USB Ripper", no "USB R.I.P." es una herramienta forense simple con interfaz de línea de comandos que le permite rastrear artefactos de dispositivos USB es decir, historial de eventos USB en máquinas Linux. Índice: Descripción Inicio Rápido Demostración Estructura del Registro...

PrintNightmare

TryHackMe | PrintNightmare PrintNightmare Learn about the vulnerability known as PrintNightmare CVE-2021-1675 and CVE-2021-34527 Task 6 Detection: Windows Event Logs Event Viewer Applications and Services Logs Microsoft Windows PrintService Admin...

Phant0m

Phant0m | Eliminador de registros de eventos de Windows Svchost es esencial en la implementación de los llamados procesos de servicio compartidos, donde varios servicios pueden compartir un proceso para reducir el consumo de recursos. Agrupar múltiples servicios en un solo proceso conserva recurs...

SolarWinds Security Event Manager - Unauthenticated RCE

The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution. id: CVE-2024-0692 info: name: SolarWinds Security Event Manager - Unauthenticated RCE...

Audix

| / /| | / / / / / |// / // // // / / // |,/ ,/ // //|| es una herramienta de PowerShell para configurar rápidamente las políticas de auditoría de eventos de Windows para monitoreo y respuesta a incidentes. Por favor, tenga en cuenta: Esta herramienta solo cambiará la política de seguridad local...

CVE-2026-76060_ZoneMinder_CommandInjection-PoC

just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...

CVE-2026-104182

A flaw was found in stream-json. A local attacker can cause a Denial of Service DoS by providing JSON with Comments JSONC input containing large comments split across multiple small chunks. The parser repeatedly rescans accumulated comment data from the beginning for each chunk, leading to...

CLEANSTART-2026-HZ65290 Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header

Security vulnerability affects the consul package. Consul and Consul Enterprise’s “Consul” event endpoint is vulnerable to denial of service DoS due to lack of maximum value on the Content Length header...

PT-2026-104151

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-103261

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...

CVE-2026-63642

SSRF in MagicMirror² Calendar Module A proof-of-concept exploit for CVE-2026-63642 and CVE-2026-63643, Server-Side Request Forgery vulnerabilities in MagicMirror²'s Calendar module that allow any unauthenticated attacker to force the server to make arbitrary HTTP requests to internal services...

CVE-2026-104182

The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...

CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2025-56243

CVE-2025-56243 - Reflected XSS in PuneethReddyHC / Event Management System v1.0 Title: Reflected Cross-Site Scripting XSS via eventid parameter in register.php Vendor / Repository: PuneethReddyHC / event-management Affected Version: 1.0 branch/tag master at the time of testing Reporter: Hafiz...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

SummaryA malicious SSH server can wedge an AsyncSSH client, and an authenticatedclient can wedge an AsyncSSH server, by sending a channel maximum packetsize of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client orSSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied valueverbatim with ...

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

ImpactThe SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POST...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Serverless Function Environment Variable Injection via Event Program Code Python Lambda sim lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environment variable overrides debug feature for key, value...

WinBypass

Windows UAC Bypass | Privilege Escalation Slui File Handler Hijack LPE - Windows 8-10 SluiHijackBypass.ps1 UAC Bypass via FodHelper - Windows 10 FodhelperBypass.ps1 UAC Bypass via Event Viewer - Windows 7 EventVwrBypass.ps1 Metasploit-Framework Module bypassuacsluihijack.rb copy...