SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2775 info: name: SysAid On-Prem = 23.3.40 - XML External Entity...

CVE-2026-88789

CVE-2026-88789 — Camel Quarkus: принудительно заданный Xalan TransformerFactory отменяет ограничения JAXP на внешний доступ Запускаемый proof-of-concept репродуктор уязвимости Apache Camel Quarkus, при которой расширение поддержки XSLT camel-quarkus-support-xalan предоставляет собственный...

EUVD-2026-91066

External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

PT-2026-104141

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

externalip-webhook

externalip-webhook créé pour traiter CVE-2020-8554 Remarque : Ce chart est obsolète pour Kubernetes version 1.21 et n'est plus pris en charge à partir de 1.22. Pour atténuer CVE-2020-8554, activez le contrôleur d'admission DenyServiceExternalIPs sur le cluster. externalip-webhook est un webhook d...

CVE-2026-71453

External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-71453

External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...

CVE-2021-29447

CVE-2021-29447 - Exploit de vulnérabilité XXE WordPress Description Ce dépôt contient un exploit pour CVE-2021-29447, une vulnérabilité XXE XML External Entity présente dans WordPress 5.7.0 et versions antérieures. La vulnérabilité existe dans la bibliothèque média qui traite les fichiers WAV,...

RP_Import_RCE

Real Player 'external::Import' Произвольная загрузка файлов, уязвимости обхода каталога приводят к удаленному выполнению кода видеодемонстрация: https://youtu.be/CONlijEgDLc Real Player использует функциональность Microsoft Internet Explorer и предоставляет свойства и методы через особый механизм...

CVE-2026-0303

Произвольное выполнение кода в Checkov CVE-2026-0303 CVE: CVE-2026-0303 | Базовая оценка CVSS: 6.3 | Уровень опасности: Низкий CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H CVE-2026-0303 — уязвимость произвольного выполнения кода в Checkov. Опубликовано Palo Alto Networks 9...

XXE-Payloads

XXE-Payloads Быстрый доступ к XXE-пейлоадам XXE: %sp;...

DEBIAN-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2025-31722

CVE-2025-31722 — Jenkins Templating Engine RCE À des fins éducatives et de recherche en sécurité autorisées uniquement. Description Vulnérabilité de contournement du sandbox dans le plugin Jenkins Templating Engine JTE = 2.5.3 qui permet à un utilisateur peu privilégié d'exécuter du code arbitrai...

CVE-2026-103923

The KaTeX JavaScript library (versions 0.11.0 through 0.18.2 ) is vulnerable to a flaw where it uses ordinary JavaScript property access for various configuration objects, such as renderer options and trust settings. This allows inherited properties to be treated as explicitly supplied values. If...

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

SummaryExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for other...

NPM: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

NPM: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Summary isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. nodemodules/foo2 starts with nodemodules/foo, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relati...

CVE-2022-0219

CVE-2022-0219 Jadx est vulnérable à une restriction incorrecte des entités externes XML CWE-611 lors de l'exportation d'un fichier APK malveillant via l'option -e contenant un AndroidManifest.xml / strings.xml malveillant vers gradle. Cela peut entraîner la divulgation de fichiers locaux lorsqu'i...

CVE-2022-30190_EXP_PowerPoint

CVE-2022-30190EXPPowerPoint Ceci est un exploit de CVE-2022-30190 sur PowerPoint. Modifiez le suffixe du fichier en 'zip' et décompressez le fichier, vous pouvez éditer \ppt\slides\rels\slide1.xml.rels et remplacer par l'ip:port de votre vps comme ceci, puis recompressez de la même manière et...