EUVD-2026-84955

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input...

EUVD-2026-84953

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

ROS-20260923-73-0003

The vulnerability in python-black is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-95381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Printing. CVE-2026-95381 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-95364

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Passwords. CVE-2026-95364 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-91738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox v...

ROS-20260923-73-0018

The vulnerability of the compatmtwfromuser function in the net/bridge/netfilter/ebtables.c module, which is part of the Linux kernel’s networking functions, is related to incorrect input of configuration data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

CVE-2024-21513

CVE-2024-21513 CVE-2024-21513 的概念验证（PoC） 漏洞利用原始文档由 Snyk 安全研究团队提供 漏洞利用 CVE-2024-21513 是 langchain-experimental 中的一个漏洞：未经验证的 SQL 查询结果被传递给 Python 的 eval 函数，从而通过基于 SQL 的输入注入实现远程代码执行。 PoC 结构 本 PoC 是一个极其基础的 Flask 应用，内嵌 HTML，用户可以在 SQLite 数据库中输入坐标。 如果用户在 y 值中输入恶意载荷，有漏洞的 LangChain-Experimental 功能会根据 x 值获取...

cve-lfi-lab

🧠 CVE 实验室：一级 SOC 分析师模拟 CVE-2025-39507 | WordPress Nasa Core 插件中的本地文件包含 📝 场景：SOC 中的一天 这是一个平常的周一。我像往常一样登录 SOC 仪表板，查看警报。其中一条引起了我的注意： 警报： 可能的本地文件包含（LFI）尝试 IP 地址： 203.0.113.44 URL： /index.php?file=../../../../etc/passwd 用户代理： curl/7.81.0 看起来有人可能正在通过操纵 URL 来访问系统文件。我的工作是调查此事，并判断是否需要上报。 🔎 CVE 背景...

CVE-2025-9816

CVE-2025-9816 WP-Statistics 插件上的存储型 XSS 扫描器（检测与 PoC） “WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin 插件（用于 WordPress）在包括 14.5.4 在内的所有版本中，由于对输入清理和输出转义不足，存在通过 User-Agent 头进行的存储型跨站脚本漏洞。这使得未经身份验证的攻击者能够在页面中注入任意 Web 脚本，当用户访问被注入的页面时这些脚本将执行。” 如何使用 root@kitploit: use virtual enviroment...

CVE-2025-56771

描述 在对ecodotempo.com.br网站进行分析时，发现了一个存储型跨站脚本XSS漏洞。该漏洞允许攻击者将恶意脚本注入到某些字段中，这些字段随后会未经适当清理便渲染给其他用户，具体出现在未认证（已断开连接）区域的首页上。 受影响端点 ecodotempo.com.br/colecoes/itens/cadastrarrealizar.php 受影响参数 name="nome" and name="descricao" Payload示例： PoC...

CVE-2025-1094

我根据 CVE-2025-1094 上的 PoC 编写了这个漏洞利用程序 CVE‑2025‑1094 | PostgreSQL 输入清理漏洞 概述 CVE‑2025‑1094 是 PostgreSQL 的 libpq 转义函数和 psql 交互工具中的一个输入清理漏洞。它源于当客户端编码设置为 BIG5 时对多字节编码处理不当。在某些条件下，这会导致转义字符被错误处理，从而允许攻击者绕过预期的查询边界。 该漏洞由 Rapid7 在分析 CVE‑2024‑12356（一个独立的影响 BeyondTrust 设备的问题）时发现。PostgreSQL...

CVE-2026-18131

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2026-18162

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to execute arbitrary code . The root cause is the improper neutralization of user-controlled input within the new Function constructor . The vulnerability has a CRITI...

CVE-2026-18131 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2026-88020

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2025-51403

漏洞标题：LiveHelperChat 4. 保存更改。 5. 重新访问部门分配设置页面并编辑别名昵称字段，跨站脚本（XSS）将执行。...

CVE-2026-88020

Autonomy Logic OpenPLC Runtime v3 is susceptible to an improper neutralization of input during web page generation vulnerability. This occurs because the web interface fails to encode a query string parameter used for program routing. Successful exploitation could allow an attacker to hijack sess...

EUVD-2026-84871

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-88020 Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...