GHSA-858H-WHJF-MVG5 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...

PT-2026-102811

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0 Description The default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced...

EUVD-2018-0046

Malware in sbrugna...

EUVD-2018-7056

Malware in sbrugna...

EUVD-2018-3729

Malware in sbrugna...

EUVD-2012-6464

Malware in sbrugna...

EUVD-2011-3350

Malware in sbrugna...

EUVD-2016-4875

Malware in sbrugna...

EUVD-2016-9708

Malware in sbrugna...

EUVD-2012-1463

Malware in sbrugna...

EUVD-2016-8635

Malware in sbrugna...

EUVD-2017-15472

Malware in sbrugna...

EUVD-2017-9368

Malware in sbrugna...

EUVD-2018-18368

Malware in sbrugna...

EUVD-2025-25769

Malicious code in bioql PyPI...

CVE-2025-9402 HuangDou UTCMS Config update.php server-side request forgery

A vulnerability was found in HuangDou UTCMS 9. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Config Handler. Performing manipulation of the argument UPDATEURL results in server-side request forgery. The attack is possible to be carri...

CVE-2025-7567

The CVE-2025-7567 issue affects the ShopXO web application up to version 6.5.0, specifically involving the header.html processing where manipulating the lang/system_type parameter enables Cross-Site Scripting (XSS). The vulnerability can be triggered remotely, and publicly disclosed exploits exis...

CVE-2025-5405 chaitak-gorai Blogbook post.php cross site scripting

A vulnerability, which was classified as problematic, has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This issue affects some unknown processing of the file /post.php. The manipulation of the argument commentauthor/commentemail/commentcontent leads to cros...

CVE-2022-4817

A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patch is b8cb29b43dc704708d598c60ac1881db7cf8e9c3. It is...

CVE-2025-4075 VMSMan login.php cross site scripting

A vulnerability was found in VMSMan up to 20250416. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Email with the input "alert1 leads to cross site scripting. The attack may be launched remotely. The...