CVE-2026-104465

Versions of YesWiki prior to 4.6.7 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the mail handler due to improper sanitization of the field parameter . Unauthenticated attackers can craft malicious links where a crafted field value breaks out of the aj...

CVE-2026-104466

YesWiki versions prior to 4.6.7 are susceptible to a stored cross-site scripting (XSS) vulnerability located in the formatters/wakka.php component. The root cause is the improper handling of quotes in markdown image URLs , which allows users with page editing or comment posting privileges to inje...

EUVD-2026-91476

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

EUVD-2026-91457

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient,...

CVE-2026-104446

YesWiki versions before 4.6.7 are vulnerable to an authentication bypass in the contact mail AJAX handler. This flaw allows unauthenticated attackers to send emails through the wiki's SMTP server by posting an XMLHttpRequest to the mail handler without required field or type parameters. Attackers...

EUVD-2026-91453

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-104442

YesWiki versions prior to 4.6.7 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is the lack of input validation in the render handler's content parameter , which allows remote attackers to supply a syndication action . This enables the server to fetch arbi...

CVE-2026-104442 YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-104442 YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-36980-Kernel-BSOD-DoS-PoC

CVE-2026-36980-Kernel-BSOD-DoS-PoC Project Date : Feb 2026 / Discovered a buffer overflow vulnerability in the IOCTL handler of the pwdrvio.sys kernel driver. The vulnerability allows an unprivileged local attacker to corrupt kernel pool memory, triggering an immediate system crash BSOD and Denia...

CVE-2026-96647

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

cve-2015-1187-dir820l-firmware-reverse-engineering

cve-2015-1187-dir820l-firmware-reverse-engineering Static firmware reverse engineering of CVE-2015-1187 in the D-Link DIR-820L using Strings, Ghidra, and Binwalk. Done by extracting MIPS root filesystem, identifying the ncc2 backend handler, and tracing pingaddr through command construction to...

CVE-2026-33718

CVE-2026-33718 OpenHands is Vulnerable to Command Injection through its Git Diff Handler Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker...

EUVD-2026-91255

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

Voidgate

VOIDGATE Description: A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes such as msfvenom by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that...

CVE-2026-79618

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...