CVE-2026-92977 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100180

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-55182-Exploit

React2Shell CVE-2025-55182 - Docker 漏洞实验室 一个刻意存在漏洞的 Next.js 应用程序，演示了通过不安全的子进程处理导致的远程代码执行（RCE）。该实验室专为教育目的和安全测试而设计。 ⚠️ 警告：切勿在公网服务器上运行此程序。它包含一个远程代码执行漏洞。 场景 该应用程序是一个简单的“服务器状态监视器”。后端接收用户提供的主机名并执行 ping 命令。然而，输入未经过滤，攻击者可以注入任意操作系统命令。 搭建 前提条件 Docker Docker Compose 运行实验室 docker-compose up -d --build 应用程序将在...

bigdecimal-segfault-fix

h1. BigDecimal 段错误修复 Ruby 的 big decimal 库中存在一个段错误缺陷，当用户提供已知的恶意值时可能被触发。如果您想测试应用程序是否安全，请运行 +example.rb+。该脚本应正常退出，不会发生段错误。 该变通方法存在负面副作用。具体来说，它会阻止您使用 BigDecimal 处理大数（超过 255 位数字）或使用科学计数法提供数字（例如，"5E6" 表示 5000000）。如果您需要这些功能，则必须升级到打过补丁的 Ruby。 强烈建议您按照 "Ruby...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-91877

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server: cabecera @ no confiable → suplantación de metadatos internos CVSS 10.0 Crítico · CWE-20 · GHSA-jrh6-9hgv-mqm7 Resumen Apache Traffic Server reserva las cabeceras con prefijo @ @Ats-Internal, @ICAP-Status, @TCPInfo, ... para metadatos internos : viven en la...

TP-LINK - Local File Inclusion

TP-LINK is susceptible to local file inclusion in these products: Archer C5 1.2 with firmware before 150317, Archer C7 2.0 with firmware before 150304, and C8 1.0 with firmware before 150316, Archer C9 1.0, TL-WDR3500 1.0, TL-WDR3600 1.0, and TL-WDR4300 1.0 with firmware before 150302, TL-WR740N...

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce 后门远程代码执行 RCE 深入技术分析：Product Slider Pro 后门漏洞 漏洞基础与成因 CWE-1284 该漏洞的技术起源被归类为 CWE-1284："对输入中指定数量验证不当"。这意味着软件接收用户输入，预期用户指定数量（例如大小、长度、数量），但未能正确验证该输入。攻击者可以利用此漏洞发送与正常预期不同的恶意输入，导致系统表现出意外行为。 . 受影响版本与补丁状态 受影响版本：3.5.3 之前的所有版本。...

[SECURITY] Fedora 45 Update: input-pad-1.1.0-7.fc45

The input pad is a tool to send a character on button to text applications...

[SECURITY] Fedora 45 Update: fcitx-4.2.9.9-15.fc45

Fcitx is an input method framework with extension support. Currently it supports Linux and Unix systems like FreeBSD. Fcitx tries to provide a native feeling under all desktop as well as a light weight core. You can easily customize it to fit your requirements...

PT-2026-104493

Name of the Vulnerable Software and Affected Versions The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress versions prior to 5.3.6 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject...

Reactivating Alignment: Defending LLMs from Jailbreaks Via Intention-Aware Input-Output Matching

Large language models LLMs remain vulnerable to jailbreak attacks that conceal harmful intent within complex adversarial prompts. Existing defenses primarily rely on input perturbation or harmful-output suppression, but they rarely model where malicious intent resides, resulting in brittle...

PT-2026-104585

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor Free Widgets, Addons, Templates versions prior to 2.0.21 Description An issue involving improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS, a technique whe...

VMWare-CVE-Check

VMWare-CVE-Check Uso: ./example.py/sh list.txt...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e 此模块需要 Metasploit：https://metasploit.com/download 当前来源：https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Popular Posts 插件认证远程代码执行', 'Description' = %q 此漏洞利用要求 Metasploit 拥有一个 FQDN，并且能够运行端口 80、443 或 8080 上的有效载荷 Web 服务器。 FQDN...

nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy Una librería para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Compatible con Java 8+. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que proporcionan para ...

CVE-2024-55270

学生管理系统 1.0 CVE-2024-55270 概述 学生管理系统（SMS）是一款基于 PHP 和 MySQL 开发的 Web 应用程序，用于管理学生信息。本仓库包含该系统的源代码和详细信息，同时附有安全漏洞报告。 审计员： Shoaib Alam - LinkedIn 个人资料 安全漏洞报告 描述 在学生管理系统中检测到了一个盲 SQL 注入 漏洞。该问题影响应用程序搜索功能中的 searchdata 参数。 易受攻击的端点： /studentms/admin/search.php 易受攻击的参数： searchdata 由于输入清理不充分，searchdata 参数容易受到盲 S...