CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

EUVD-2026-70985

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85547

CVE-2026-85547 is a cross-site request forgery (CSRF) vulnerability in MISP (Malware Information Sharing Platform). The root cause is that MISP's _isRest() check disables form-security and CSRF protections when a request is identified as REST, but this detection can be manipulated by an attacker-...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85509

A flaw was found in FreeIPMI. This vulnerability is a stack-based buffer overflow in the readfrudata function, which occurs when a Baseboard Management Controller BMC returns more bytes than requested. A remote attacker could exploit this flaw by sending a specially crafted response, potentially...

CVE-2026-27280

Escritura fuera de límites en dngrendertask::ProcessArea Adobe DNG SDK / Android Alcanzable desde un archivo DNG ordinario a través de la API pública de decodificación de imágenes de Android , y reproducido en un Galaxy S25 usando el propio/system/lib64/libdngsdk.so del teléfono. Vulnerable: DNG...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

metasploitable2-exploitation-metasploit

Exploiting Metasploitable2 with Metasploit: VSFTPD, Samba, and More A hands-on walkthrough of exploitation using the Metasploit Framework — from PostgreSQL database setup and dbnmap scanning, through three root shells via vsftpd, Samba, and UnrealIRCd, to credential exfiltration with Netcat...

-CVE-2025-8088

-CVE-2025-8088 POWERSHEL script to check if your device is affected or no 🚨 CVE-2025-8088: WinRAR Zero-Day Alert! 🚨 A critical WinRAR vulnerability CVE-2025-8088 is making headlines – attackers can exploit this flaw in versions 7.13 to execute malicious code just by tricking users into opening a...

CVE-2025-13486

CVE-2025-13486 exploit ACF Extended WordPress Plugin — Remote Code Execution & Privilege Escalation Exploit for the CVE-2025-13486 discovered by Marcin Dudek dudekmar ⚠️ Disclaimer This repository is provided for research and defensive security purposes only. The author assumes no responsibility...

cve-2025-64446-fortiweb-exploit

CVE-2025-64446 Fortinet FortiWeb Path Traversal RCE Exploit A security research tool for detecting and testing the CVE-2025-64446 vulnerability in Fortinet FortiWeb Web Application Firewall WAF. This critical zero-day path traversal vulnerability has been actively exploited in the wild and allows...

CVE-2025-33053_PoC

CVE-2025-33053 POC Exploit Overview The working directory in a .url file can be set to a foreign WebDAV server. When opened by a Windows client, dependencies for the executable defined in the URL field are searched for in the foreign WebDAV share. If an arbitrary executable or DLL is given the sa...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...

CVE-2025-13486

🔴 CVE-2025-13486 - Advanced Custom Fields Extended ACFE WordPress Plugin Exploit 📋 Overview Proof-of-concept exploit for CVE-2025-13486 , a critical vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin that allows Remote Code Execution leading to Privilege Escalation. 🎯...

CVE-2026-85538

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required permmodify or permmodifyorg permissions. The affected attribute deletion paths relied on organization membership checks performed by...

CVE-2025-63499

Targeted Reflected XSS in theme parameter Researchers: Arseniy Poblaguev, Daniil Khomichenok Affected Versions = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 Date: 02.12.2025 In the theme parameter there are Reflected XSS Vulnerability:...

CVE-2025-64087-SSTI-

CVE-2025-64087 SSTI FreeMarker Server-Side Template Injection SSTI in XDocReport allows Remote Code Execution via Apache FreeMarker engine Bug Definition Overview of the vulnerability Server-Side Template Injection SSTI is a web security vulnerability that allows attackers to inject malicious cod...

EUVD-2026-70958

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required permmodify or permmodifyorg permissions. The affected attribute deletion paths relied on organization membership checks performed by...

CVE-2026-85538

CVE-2026-85538 is an incorrect authorization vulnerability in MISP , where attribute deletion paths in MispAttribute::deleteAttribute() relied solely on organization membership checks without enforcing MISP's ACL::canModifyEvent() authorization logic. An authenticated user with organization membe...