CVE-2025-65482-XXE-

CVE-2025-65482 XXE XML External Entity Injection XXE en XDocReport Definición del error XML External Entity Injection Resumen de la vulnerabilidad XML External Entity Injection XXE es una vulnerabilidad en el procesamiento de datos en formato XML, donde el usuario inserta datos XML que hacen...

CVE-2025-26054

CVE-2025-26054 CVE-2025-26054 Author: Rohan Deshpande Stored Cross Site Scripting Summary Stored XSS Cross-Site Scripting is a security vulnerability that occurs when an attacker injects malicious scripts into a web application, which are then stored on the server and served to users. When users...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 Joomla Unauthenticated Information Disclosure Description Supports high-concurrency detection Write url into urls.txt, only supports http://ip:port & https://ip:port format Use the -p parameter to add a proxy Just run Usage Help .\CVE-2023-23752.exe -h ██████╗██╗...

Open5GS-CVE-2025-41067-CVE-2025-41068-PoC

Denegación de Servicio en NRF de Open5GS CVE-2025-41067 y CVE-2025-41068 Este repositorio contiene scripts de explotación de Prueba de Concepto PoC para dos vulnerabilidades de alta severidad descubiertas en Open5GS de NewPlane. Estas vulnerabilidades pueden ser desencadenadas por un atacante par...

CVE-2019-15233

CVE-2019-15233 FAB-2019-00157 Vulnerabilidad descubierta por mí CVE-2019-15233 Aviso: advisory Información básica Advisory ID: FAB-2019-00157 Product: Live Input Macros Manufacturer: Old Street Solutions Affected Versions: 2.10 and before Tested Versions: 2.10 Vulnerability Type: Cross-Site...

EUVD-2026-91935

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

[SECURITY] Fedora 45 Update: pacemaker-3.0.3-2.fc45

Pacemaker is an advanced, scalable High-Availability cluster resource manager. It supports more than 16 node clusters with significant capabilities for managing resources and dependencies. It will run scripts at initialization, when machines go up or down, when related resources fail and can be...

CVE-2024-50508

CVE-2024-50508 Woocommerce Product Design = 1.0.0 - Descarga Arbitraria de Archivos No Autenticada Descripción El plugin Woocommerce Product Design para WordPress es vulnerable a Directory Traversal en todas las versiones hasta, e incluyendo, 1.0.0. Esto permite que atacantes no autenticados lean...

CVE-2024-30088-

Debilidad: CWE-367: Condición de carrera de verificación en el momento de uso TOCTOU Fuente CVSS: Microsoft CVSS: 3.1 7.0 / 6.3...

PT-2026-104521

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.2 Description Insufficient validation of file types within uploaded archives and a lack of content sanitization before storage in a publicly accessible location allow high-privilege users to execute...

CVE-2024-28995

Exploit Para CVE-2024-28995 El 5 de junio de 2024, SolarWinds publicó un aviso para CVE-2024-28995, una vulnerabilidad de recorrido de directorios de alta gravedad que afecta a su solución de transferencia de archivos Serv-U. La vulnerabilidad fue descubierta por el investigador Hussein Daher de...

Pwdb-Public

PWDB - Nueva generación de análisis masivo de contraseñas Objetivo Dejando atrás las cosas de hace 20 años del red team. Las cosas funcionan bien, y nadie se molesta en revisarlas/reemplazarlas durante décadas. Dumps incluidos Puedes consultar el archivo status.txt en este repositorio para hacer...

CVE-2026-8054

1. Resumen de la vulnerabilidad CVE-2026-8054 es una vulnerabilidad crítica de inyección SQL sin autenticación previa Pre-auth SQL Injection que existe en la API de Auditoría de Publicación Publish Audit API de dotCMS Core. Esta vulnerabilidad es rastreada oficialmente como incidente de seguridad...

CVE-2026-5513

CVE-2026-5513 — Bookly ≤ 27.2 XSS Almacenado a través de Cookie Resumen Campo| Valor ---|--- CVE ID| CVE-2026-5513 Vulnerabilidad| Cross-Site Scripting Almacenado XSS Plugin| Bookly — Sistema de Programación y Reserva de Citas en Línea Afectado| ≤ 27.2 Parcheado| 27.3+ CVSS 3.1| 7.2 Alto —...

EUVD-2026-91373

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

CVE-2026-103880 Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113 – Inyección de Cabeceras SMTP en el Formulario de Contacto Código del Programa Python contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact: sender =...

stenographer

Stenographer 개요 Stenographer는 전체 패킷 캡처 유틸리티로, 침입 탐지 및 사고 대응 목적으로 디스크에 패킷을 버퍼링합니다. 고성능 NIC-디스크 패킷 쓰기 구현을 제공하며, 디스크가 가득 차면 해당 파일을 삭제하고, 특정 패킷 세트를 빠르고 쉽게 읽어올 수 있는 방법을 제공합니다. 다음과 같은 용도로 설계되었습니다: 디스크에 매우 빠르게 패킷 쓰기 멀티코어, 멀티디스크 시스템에서 10Gbps 가능한 많은 기록 저장 디스크 사용량 관리, 트래픽이 느릴 때 더 오래 저장, 디스크 한계에 도달하면 가장 오래된...

SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:4401-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4401-1 advisory. Security issues fixed: - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead ...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...