31594 matches found
Exploit for Improper Restriction of XML External Entity Reference in N-Able N-Central
No d...
Notepad++ 8.9 Persistence Module
This Metasploit post-exploitation module abuses a legitimate Notepad++ feature by modifying the shortcuts.xml configuration file to register a custom external tool. The added tool appears in the Notepad++ Run menu and executes a user-defined command when manually selected by the user. This...
CVE-2026-24889
creationtimestamp| type| source ---|---|--- 2026-01-28 23:34:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdjgrbuekb2c...
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
Summary An unvalidated redirect open redirect vulnerability exists in NocoDB’s login flow due to missing validation of the continueAfterSignIn parameter. During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing an...
GHSA-3HMW-8MW3-RMPJ NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
Summary An unvalidated redirect open redirect vulnerability exists in NocoDB’s login flow due to missing validation of the continueAfterSignIn parameter. During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing an...
CVE-2026-1475
An out-of-band SQL injection vulnerability OOB SQLi has been detected in the Performance Evaluation EDD application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter ‘Idusuario' in ‘/evaluacionaccionesevalua.aspx’, could allow an attacker to extract...
CVE-2026-1482
An out-of-band SQL injection vulnerability OOB SQLi has been detected in the Performance Evaluation EDD application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Idevaluacion' in '/evaluacionobjetivosevaluadefinido.aspx', could allow an attacker to...
CVE-2026-24768 NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect open redirect vulnerability exists in NocoDB’s login flow due to missing validation of the continueAfterSignIn parameter. During authentication, NocoDB processes a user-controlled redirect...
CVE-2026-24768
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect open redirect vulnerability exists in NocoDB’s login flow due to missing validation of the continueAfterSignIn parameter. During authentication, NocoDB processes a user-controlled redirect...
CVE-2026-24768 NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect open redirect vulnerability exists in NocoDB’s login flow due to missing validation of the continueAfterSignIn parameter. During authentication, NocoDB processes a user-controlled redirect...
EUVD-2025-206446
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path. Go Vulnerability Report: Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive i...
Malicious code in chai-as-hashed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f41b3bfa5c5bc9d3d747e0e36e6ac8139a2735004b33987b7c3706562f0a0246 The package chai-as-hashed was found to contain malicious code. Source: ghsa-malware 0f0e1b090cb9db7ad2687185748d227939549417c35f6cf08d5ec1e7c001b37b...
Denial Of Service (DoS)
Next.js is vulnerable to a Denial-Of-Service DoS. The vulnerability is due to unbounded memory consumption in the Image Optimizer, where the /next/image endpoint loads attacker-controlled external images entirely into memory without size limits when remotePatterns is enabled, allowing large image...
MAL-2026-573 Malicious code in primebeem-db (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f1198676da63547b3cee3d253b405d8e3dede154ddbe5ea600ae12bd9f5d1 The package primebeem-db was found to contain malicious code. Source: ghsa-malware 12f10893865523e5ced704d651ea8f536db02fb4352114b3c243b7978e237254 A...
CVE-2026-1298
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the imagereplacementfromurl function that is hooked to the erifromurl AJAX action. This makes it possible for authenticated...
CVE-2026-1298 Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the imagereplacementfromurl function that is hooked to the erifromurl AJAX action. This makes it possible for authenticated...
CVE-2026-1298
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the imagereplacementfromurl function that is hooked to the erifromurl AJAX action. This makes it possible for authenticated...
CVE-2026-1298
The CVE-2026-1298 entry refers to the WordPress plugin Easy Replace Image (
EUVD-2026-4865
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the imagereplacementfromurl function that is hooked to the erifromurl AJAX action. This makes it possible for authenticated...