amd_eop_poc

amdeoppoc CVE-2020-8950 AMD User Experience Program Launcher from Radeon Software Privilege Escalation FileWrite eop Read the note.txt https://heynowyouseeme.blogspot.com/2020/02/privilege-escalation-filewrite-eop-in.html...

aura-inspector

aura-inspector Este não é um produto oficialmente suportado pelo Google. Este projeto não é elegível para o Programa de Recompensas por Vulnerabilidades de Software de Código Aberto do Google. Introdução aura-inspector é um canivete suíço para testes do Salesforce Experience Cloud. Ele facilita a...

SiteCore-RCE-Detection

SiteCore-RCE-Erkennung Zur Erkennung von sitecore RCE - CVE-2021-42237 Sitecore Experience Platform Pre-Auth RCE - CVE-2021-42237 Verlässt sich auf die sitecore-Versionserkennung und die Antwort, wenn eine Anfrage an die anfällige Report.ashx mittels GET und POST gestellt wird. Das Skript nimmt...

voltron

Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

Adobe Experience Manager ≤ 6.5.23.0 - XML Injection

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. id: CVE-2025-54251 info: name: Adobe Experience Manager ≤ 6.5.23.0 - XML Injection author: DhiyaneshDK,assetnote severity: medium description: |...

CVE-2025-53694-to-CVE-2025-53691

Sitecore CVE-Ketten-Exploits Dieses Repository enthält Proof-of-Concept-Exploits für eine kritische Schwachstellenkette in Sitecore Experience Platform XP-Versionen bis 10.4.1. Schwachstellen CVE-2025-53694: Offenlegung von Informationen CVE-2025-53693: Cache-Vergiftung CVE-2025-53691:...

Sitecore Experience Platform - Deserialization of Untrusted Data

Sitecore Experience Platform before 8.2 Update-7 and 9.0 before Update-2 is vulnerable to a remote code execution vulnerability CVE-2019-9874. An attacker can exploit this issue to execute arbitrary code on the affected system via a crafted request to the...

Sitecore - Remote Code Execution

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. id: CVE-2023-35813 info: name: Sitecore - Remote Code Execution author: DhiyaneshDk,iamnoooob severity: critical description: | Multiple Sitecore...

Sitecore Experience Platform <= 10.4 - Arbitrary File Read

An issue was discovered in Sitecore Experience Platform XP, Experience Manager XM, and Experience Commerce XC 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files. id: CVE-2024-46938 info: name: Sitecore Experience Platform = 10.4 - Arbitrary File...

hopgoblin

hopgoblin hopgoblin è uno scanner per istanze di Adobe Experience Manager AEM. Automatizza una serie di controlli che eseguiamo spesso manualmente durante le valutazioni di sicurezza. Caratteristiche Rileva endpoint QueryBuilder esposti: /bin/querybuilder.json /bin/querybuilder.feed Abusa di...

aem-xss

Badge Licenza MIT Installazione...

logto-tunnel serves files outside --experience-path via path traversal

Summary @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command...

CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

CVE-2026-71038

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-71037

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-71036

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-71021

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HT...