CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...

CVE-2026-34156

🚨 CVE-2026-34156 - NocoBase Critical Sandbox Escape Unauthenticated / Low-Privilege → Root Remote Code Execution in NocoBase 📌 Overview CVE-2026-34156 is a critical sandbox escape vulnerability in NocoBase an open-source no-code/low-code platform. An attacker with the ability to create or execute...

CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit

CVE-2026-20245 - Cisco SD-WAN Privilege Escalation Exploit ⚠️ ADVERTENCIA Este código es SOLO para fines educativos y pruebas de seguridad autorizadas. 📋 Descripción CVE-2026-20245 es una vulnerabilidad de escalada de privilegios en la CLI de Cisco Catalyst SD-WAN Controller vSmart, Cisco Catalyst...

EUVD-2026-65209

Grav: Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion...

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...

GHSA-JQ29-C7V8-RG55 Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...

SkypeACLKeyGen.exe-analysis-for-hacking-team

SkypeACLKeyGen.exe analysis for hacking team So... what do we analyse today ? well today we analyse a piece of software from hacking team. It's about skype? why do we do this ? idk i find it interesting. So anyway we start by inspecting runtime behaviour. As you can see it requires a username and...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

GHSA-GQ9C-WMRM-5HVR HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

Summary A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service. Details The...

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger tha...

GHSA-8WMF-6V46-5GFG OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger tha...

ReverseSocks5

ReverseSocks5 Reverse SOCKS5 proxy in Golang. Usage root@kitploit: Usage of ReverseSocks5.exe: -cert string Certificate file if using TLS on the server -connect string Connect address for socks agent address:port -k Skip TLS certificate verification when using -tls insecure -key string Private ke...

EUVD-2026-65211

Grav: mediadirectory Twig function allows filesystem path traversal and file content disclosure from sandboxed page content...

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...

GHSA-47CH-6W46-6XM7 Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...

GHSA-3JHR-MXMX-38CX Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. Versions 3.4.1 through 4.0.1 are affected by an arbitrary memory write vulnerability in parse_level0_xml() within src/openslide-vendor-ventana.c. A crafted Ventana BIF file can supply nonpositive row or column tile counts, producing at...

CVE-2026-48977 OpenSlide: Arbitrary memory write with crafted Ventana BIF file

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parselevel0xml processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memo...

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parselevel0xml processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memo...