Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

ECOA Building Automation System - Arbitrary File Retrieval

The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information. id: CVE-2021-41293 info: name: ECOA Building Automation...

Prestashop Blockwishlist 2.1.0 SQL Injection

Prestashop Blockwishlist module version 2.1.0 suffers from a remote authenticated SQL injection vulnerability. id: CVE-2022-31101 info: name: Prestashop Blockwishlist 2.1.0 SQL Injection author: mastercho severity: high description: | Prestashop Blockwishlist module version 2.1.0 suffers from a...

Post Sync Plugin <= 1.1 - Cross-Site Scripting

Post Sync WordPress plugin = 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a maliciou...

CVE-2020-1938

CVE-2020-1938 Suricata 탐지 규칙 CNVD-2020-10487 CVE-2020-1938 alert tcp any any - any 8009 msg:"CNVD-2020-10487 Ghostcat"; content:"javax|2e|servlet|2e|include|2e|requesturi"; content:"javax|2e|servlet|2e|include|2e|pathinfo"; content:"javax|2e|servlet|2e|include|2e|servletpath";...

PT-2026-107867

🔐 Security news curl founder Daniel Stenberg says curl 8.23.0 will fix 22 security vulnerabilities on 14 October 2026, including one rated HIGH. That flaw brought the release forward by a few weeks. → CVE-2026-92392 is the new HIGH-severity flaw → The other 21 vulnerabilities are less serious →...

EUVD-2026-43179

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats...

CVE-2023-25690-POC

CVE 2023 25690 - 개념 증명 게시일: 2023년 3월 7일 기본 점수| 기밀성| 무결성 영향| 가용성 영향 ---|---|---|--- 9.8| 높음| 높음| 높음 목차 권고 설명 취약한 Apache 설정 분석 데이터 흐름 랩 설정 HTTP 요청 분할로 인한 백엔드 서비스의 HTTP 요청 밀반입 CRLF 주입 식별 헤더 주입을 통한 내부 HTTP 요청 밀반입 영향 권고 설명 Apache HTTP Server 버전 2.4.0 부터 2.4.55 까지의 일부 modproxy 설정 은 HTTP 요청 밀반입HTTP...

How-to-Patch-CVE-2025-32709

CVE-2025-32709 취약점 패치 방법 CVE-2025-32709에 대한 실제 패치 워크플로우입니다. 핫픽스 설치부터 SIEM 알림 검증까지 — 이 저장소는 스크린샷, 명령어 및 탐지 로직과 함께 모든 단계를 문서화합니다. Windows 10 Pro 엔드포인트에서 CVE-2025-32709가 높은 심각도 취약점으로 플래그된 Wazuh 취약점 탐지 대시보드의 스크린샷. 에이전트 window10 004는 하나의 높은 심각도 문제를 보고하고 있으며, 시스템이 현재 노출 상태임을 확인합니다. 이 이미지는 패치 전 기준선 역할을 ...

CVE-2026-107168

A flaw exists in m17n-lib where providing crafted input with an invalid UTF-8 character sequence can cause the text parsing function count_utf_8_chars() to enter an infinite loop . This vulnerability leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected ...

CVE-2026-107168 M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service DoS for the affected application...

CVE-2026-107168 M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service DoS for the affected application...

Zoho ManageEngine OpManager - SQL Injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

SonicWall GMS and Analytics - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics:...

SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass

The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...

VMware Aria Operations for Networks - Remote Code Execution

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. id:...

PaperCut NG - Authentication Bypass

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper...

cve-2024-52005-poc

CVE-2024-52005: Git의 ANSI 이스케이프 시퀀스 삽입 개요 이 저장소는 Git 작업 중 사이드밴드 채널을 통한 ANSI 이스케이프 시퀀스 삽입 취약점인 CVE-2024-52005에 대한 개념 증명PoC을 포함합니다. CVE-2024-52005 는 높은 심각도CVSS 7.5의 취약점으로, Git 2.48.1, 2.47.3, 2.46.5, 2.45.4, 2.44.3 이전 버전에 영향을 미칩니다. 문제점 이 PoC는 일부 강화된 컨테이너 이미지가 VEX취약점 악용 가능성 교환 문서에서 "영향 없음notaffected...

CVE-2026-101156

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...

EUVD-2026-93960

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...