395191 matches found
CVE-2026-65711 sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via stri...
EUVD-2026-44933
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by kiota info...
GHSA-HQ9Q-27G5-QWPJ Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Summary kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand and dependency name/version as the tool's own recommended install...
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Summary kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand and dependency name/version as the tool's own recommended install...
GHSA-4RJ6-VRWV-WR8M Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...
Exploit for Deserialization of Untrusted Data in Facebook React
💀 React2Shell Exploit — CVE-2025-55182 ██████╗ ███████╗...
GHSA-WFP6-F47H-HXC3 AWS CLI: Overly permissive File Permissions
Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...
AWS CLI: Overly permissive File Permissions
Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...
Exploit for OS Command Injection in Ispyconnect Agent_Dvr
CVE-2025-63408 --- path-traversal.py: A re-implementation o...
CVE-2026-65693
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693
Microweber CMS up to version 2.0.20 exposes a server-side template injection in mail templates via Twig in TwigView::render(). The unsandboxed Twig environment, lacking SandboxExtension or a SecurityPolicy, allows authenticated administrators to inject Twig expressions (e.g., filter('system')) in...
EUVD-2026-48665
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff ha...
Don’t get fooled by TikTok resin art scams
Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that eith...
Call of Duty Mobile scam uses fake free points to steal player accounts
Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway. Victims are asked to log in with their email address and password to claim free Call of Duty Points CP, the game's premium currency. They're then redirected to a second page aski...