polyshell

PolyShell: a Bash/Batch/PowerShell polyglot What It Is PolyShell is a script that's simultaneously valid in Bash, Windows Batch, and PowerShell i.e. a polyglot. This makes PolyShell a useful template for penetration testing as it can be executed on most systems without the need for target-specifi...

polyshell

PolyShell: un políglota de Bash/Batch/PowerShell Qué es PolyShell es un script que es válido simultáneamente en Bash, Windows Batch y PowerShell es decir, un políglota. Esto convierte a PolyShell en una plantilla útil para pruebas de penetración, ya que se puede ejecutar en la mayoría de los...

CVE-2021-40303

CVE-2021-40303 perfex crm 1.10 es vulnerable a Cross Site Scripting XSS Almacenado a través de /clients/profile. poc: root@kitploit: POST /clients/profile HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept:...

CVE-2018-7600-PoC

SAWPOC — CVE-2018-7600 A Python Proof of Concept for CVE-2018-7600 , also known as Drupalgeddon2. CVE-2018-7600 is a critical vulnerability affecting certain versions of Drupal 7. Under vulnerable configurations, an unauthenticated attacker may be able to inject malicious input and achieve remote...

CVE-2026-44766

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

EUVD-2026-72573

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

PT-2026-86948

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

The vulnerability of the input-remapper.service service, a device management tool for input devices, allows a malicious actor to switch the service to a specified configuration directory and initiate an injection mechanism for input data.

The vulnerability of the input-remapper.service service, a device management tool for input devices, is related to the lack of authentication. Exploiting this vulnerability allows an attacker to switch the service to a specified configuration directory and activate the mechanism for injecting...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

GHSA-Q7M3-RHXG-7VXR n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

PT-2026-76824

Name of the Vulnerable Software and Affected Versions MLflow versions 3.13.0 through 3.14.x Description When deployed with the built-in basic-auth plugin, an authenticated user can inject arbitrary dataset records into another user's run. This occurs because the LogInputs proto handler is missing...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

MiracleLinux 9 : golang-1.26.4-1.el9_8 (AXSA:2026-1418:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1418:07 advisory. net/textproto: golang: Golang net/textproto: Misleading error messages via input injection CVE-2026-42507 Tenable has extracted the preceding description blo...

EUVD-2026-51027

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-48539

GFI Archiver prior to 15.13 is affected by CVE-2026-48539: a stored XSS in the MailInsights.aspx report naming parameter. An authenticated user can inject script/HTML that is stored by ReportScheduling.btnSaveReport_Click() and later executes in the viewer’s browser when they access the MailInsig...

CVE-2026-64812

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64812

CVE-2026-64812 affects JetBrains IntelliJ IDEA prior to 2026.2. The vulnerability allows unauthorized input injection during a Remote Development session. Root cause details are not elaborated beyond the description; exploitation status and mitigation are not specified in the provided documents. ...