CVE-2021-38619

CVE-2021-38619 openBaraza HCM HR Payroll v.3.1.6 Unauthenticated Stored XSS Vulnerability openBaraza HCM v.3.1.6 does not properly neutralize user-controllable input, this could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative...

CVE-2025-51403

Exploit Title: LiveHelperChat 4. Save the changes. 5. Revist the Department Assignment settings page and edit the Alias Nick field, the...

API-Security-Checklist

繁中版 | 简中版 | العربية | Azərbaycan | Български | বাংলা | Català | Čeština | Deutsch | Ελληνικά | Español | فارسی | Français | हिंदी | Indonesia | Italiano | 日本語 | 한국어 | ພາສາລາວ | Македонски | മലയാളം | Монгол | Nederlands | Polski | Português Brasil | Русский | ไทย | Türkçe | Українська | Tiếng Việt...

CVE-2021-4045

CVE-2021-4045 CVE-2021-4045 is a Command Injection vulnerability that allows Remote Code Execution in the TP-Link Tapo c200 IP camera. It affects all firmware versions prior to 1.1.16 Build 211209 Rel. 37726N due to insufficient checks on user input in uhttpd, which is one of the main binaries of...

CVE-2024-34693

CVE-2024-34693: Server Arbitrary File Read in Apache Superset Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with localinfile enabled. By enabling localinfile in the Superset MySQL/MariaDB client and pointing the...

CVE-2019-6690

Summary It is a simple PoC of Improper Input Validation in python-gnupg 0.4.3 CVE-2019-6690. Vulnerable python python-gnupg 0.4.3 python python-gnupg 0.3.6 python python-gnupg 0.3.5 python python-gnupg 0.3.4 Mitigation Users should upgrade to 0.4.4 Test Environment Docker Image docker pull...

CVE-2026-33147

CVE-2026-33147 CVE-2026-33147Stack-based Buffer Overflow in gmtremotedatasetid Summary A stack-based buffer overflow vulnerability was identified in the gmtremotedatasetid function within src/gmtremote.c. This issue occurs when a specially crafted long string is passed as a dataset identifier e.g...

PHP-Injection-in-M4-PDF-Extensions

PHP-Injection-in-M4-PDF-Extensions CVE-2023-50029 is a PHP injection vulnerability in the M4 PDF Extensions module. This vulnerability allows attackers to inject and execute arbitrary PHP code on the server, enabling them to gain full control over the targeted system. The issue lies in the improp...

CVE-2022-24086-RCE-PoC

CVE-2022-24086 RCE POC About CVE-2022-24086 which Adobe saw being “exploited in the wild in very limited attacks” received a severity score of 9.8 out of 10, and adversaries exploiting it can achieve remote code execution on affected systems without the need to authenticate. Issue that is now...

CVE-2024-46635

CVE-2024-46635 Background The GongZhiDao System is a platform developed by GongZhiDao. It provides enterprise solutions including user management, data analysis, and operational functionalities. However, a security vulnerability was discovered in one of the API endpoints that could potentially le...

CVE-2019-9745

Author: Arn Vollebregt Introduction Creativity is at the core of penetration testing, which keeps our work interesting. One pitfall however is the tendency to 'over-engineer' attack scenarios and focus solely on bugs error conditions. Flaws unintended behaviour may however be present with equally...

CVE-2024-4323

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-4323...

CVE-2024-0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

POC-CVE-2026-19679

CVE-2026-19679 — insufficient sanitization of uploaded filenames input validation Status: CONFIRMED on a 6.7.2-14.el9 lab 2026-08-20. POST /rest/auditFile with tailoringOriginalFilename = "poc;touch$IFSpoc19679;me.xml" returned HTTP 200 and registered AuditFile 1000002 — the shell-metachar filena...

CVE-2025-47812

CVE-2025-47812 Improper input validation led to Remote Code Execution to full system compromise 📘 Introduction: Julien Ahrens from RCE Security discovered a critical security vulnerability impacting WingFTP. Tracked as CVE-2025-47812, the vulnerability has a CVSS score of 10. Successful...

CVE-2023-31584

CVE-2023-31584 - Cross Site Scripting vulnerability in cu/silicon Github link: https://github.com/cu/silicon Version Affected: 1 Severity and CVSS: Will update when review is done by NIST. Type: Cross Site Scripting Root Cause: Lack of proper input validation and sanitization before inserting...

CVE-2019-6690-python-gnupg-vulnerability

CVE-2019-6690: Improper Input Validation in python-gnupg 0.4.3 We discovered a way to inject data trough the passphrase property of the gnupg.GPG.encrypt and gnupg.GPG.decrypt methods when symmetric encryption is used. The supplied passphrase is not validated for newlines, and the library passes...

CVE-2025-46178

CVE-2025-46178 Cross-Site Scripting XSS vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or...

CVE-2021-3754

CVE-2021-3754 This repository documents Vulnerability details and exploit for CVE-2021-3754 discovered and reported by Anurag Mondal 7Ragnarok7 on 21st August 2021 Metrics CWE-20: Improper Input Validation CVSS: 5.3 MEDIUM Description A flaw was found in Apache Keycloak & Redhat SSO where an...

cve-2026-13934

CVE-2026-13934 This is the work project repository. Investigation, analysis, work, and reports are handled in one repo D088/D091. This file is the repository/board entry document. For the full folder and artifact conventions, see docs/conventions.md. The body status, conclusions, links is updated...