330063 matches found
EUVD-2026-70394
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...
CVE-2026-85159
AVideo (through commit c91b5975d) contains a reflected cross-site scripting vulnerability in userLogin.php . The root cause lies in the isSafeRedirectURL function, which validates only the URL protocol but does not sanitize HTML characters in the cancelUri parameter. Because this parameter is ech...
CVE-2026-85158
AVideo through commit c91b5975d is affected by a reflected cross-site scripting (XSS) vulnerability in videoEmbeded.php . The root cause is that the link parameter is echoed inside an HTML comment with zero escaping , allowing an attacker to close the comment with --> and inject arbitrary Java...
CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...
CVE-2026-85159 AVideo Reflected XSS via cancelUri in userLogin.php
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...
EUVD-2026-70393
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...
CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...
CVE-2026-85159 AVideo Reflected XSS via cancelUri in userLogin.php
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...
EUVD-2026-70392
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...
CVE-2026-85157
WWBN AVideo is affected by a broken access control vulnerability in the unauthenticated feed/index.php (RSS feed) endpoint. When a program_id parameter is supplied, per-video visibility checks are disabled, allowing unauthenticated attackers to enumerate playlist identifiers and retrieve unlisted...
CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...
CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...
CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...
EUVD-2026-70390
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...
CVE-2026-85155
WWBN AVideo is vulnerable to SQL injection in the sort column parameter of the get.json.php endpoint when APIName=channels. An unauthenticated attacker can order results by arbitrary database columns such as users.password and users.recoverPass, enabling an ordering oracle to infer password hash ...
CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...
CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...
CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...
RingReaper
RingReaper RingReaper هو وكيل ما بعد الاستغلال post-exploitation بسيط لنظام لينكس، صُمم لمن يحتاجون إلى العمل بتخفٍّ شديد، ما يقلل فرص اكتشافه بواسطة حلول EDR. كانت الفكرة وراء هذا المشروع هي الاستفادة من iouring ، واجهة الإدخال/الإخراج غير المتزامنة الجديدة في نواة لينكس، وتحديدًا لتجنب استدعاءا...
PyMemoryEditor v2.2.0
PyMemoryEditor A pure-Python library built on ctypes that lets you inspect, modify and search the memory of any running process in a few lines of Python — Cheat Engine workflows on Windows, Linux and macOS! Read, write and scan the memory of any process — straight from Python. One unified API...