CVE-2023-43876-October-CMS-Reflected-XSS---Installation

October CMS Reflected XSS v3.4.16 Author: Sergio Description: Cross-Site Scripting XSS vulnerabilitiy in installation of October v.3.4.16 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field. Attack Vectors: A vulnerability in the...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

EUVD-2026-76122

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks by placing environment variable assignments before allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to trigger c...

CVE-2006-3392

CVE-2021-42913 Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from...

seccubus

About Seccubus Seccubus automates regular vulnerability scans with various tools and aids security people in the fast analysis of its output, both on the first scan and on repeated scans. On repeated scan delta reporting ensures that findings only need to be judged when they first appear in the...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

EUVD-2026-76121

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

CVE-2026-87986

Mistral Vibe is affected by an arbitrary code execution vulnerability (CVSS 4.0: 10.0 CRITICAL ). An attacker can bypass command permission checks by embedding shell constructs that the product's parser cannot interpret. Because unparsed portions are omitted from inspection , embedded commands ex...

CVE-2024-7029

PoC tool for exploiting CVE-2024-7029 in AvTech devices 🎤 README Translation English فارسی 📸 Screenshot 💎 Introduction CVE-2024-7029 highlights a severe security issue in AVTech devices, where attackers can bypass authentication and execute arbitrary commands remotely. This vulnerability poses...

VUL4J-23

Apache Sling Bringing Back the Fun! Apache Sling is a web framework that uses a Java Content Repository, such as Apache Jackrabbit, to store and manage content. Sling applications use either scripts or Java servlets, selected based on simple name conventions, to process HTTP requests in a RESTful...

CVE-2023-4220

CVE-2023-4220 PoC Chamilo LMS Unauthenticated Big Upload File RCE This repository contains a Proof of Concept PoC for CVE-2023-4220 , a Remote Code Execution RCE vulnerability affecting Chamilo LMS. This vulnerability allows unauthenticated attackers to exploit a large file upload feature, leadin...

CVE-2023-49987

CVE-2023-49987 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "tname" parameter on "newterm" Description : A cross-site scripting XSS vulnerability in the component “newterm” of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or...

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence AI company has branded Generative...

CVE-2019-9194-elFinder-Command-Injection-PoC

CVE-2019-9194 — elFinder Command Injection PoC Command injection vulnerability in elFinder = 2.1.47 via the PHP connector component. Allows unauthenticated remote code execution as the web server user. How it works Uploads a valid JPEG with a malicious filename containing a shell command. Trigger...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi Status Resources Contacts !Track Issueshttps://img...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...