4081 matches found
Pinger 1.0 - Remote Code Execution
Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters. id:...
nautilus
Nautilus 2.0 Nautilus is a coverage guided, grammar based fuzzer. You can use it to improve your test coverage and find more bugs. By specifying the grammar of semi valid inputs, Nautilus is able to perform complex mutation and to uncover more interesting test cases. Many of the ideas behind this...
WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS
Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires...
CVE-2026-91334
A flaw was found in OpenJDK's ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface API. Successful exploitation can result in...
Linux Distros Unpatched Vulnerability : CVE-2026-96229
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network. CVE-2026-96229 Note that Nessus relies on the...
Pillow command injection vulnerability
Pillow versions from 2.6.0 to 13.0.0 contain a command injection vulnerability. This vulnerability arises from parameter injection when calling Ghostscript to process EPS inputs. In EpsImagePlugin.Ghostscript, the input file name controlled by the attacker is passed after the -f parameter without...
CVE-2026-111869
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit i...
CVE-2026-111869 makeplane API Endpoint reliance on untrusted inputs in a security decision
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit i...
EUVD-2026-103380
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit i...
CVE-2026-111869 makeplane API Endpoint reliance on untrusted inputs in a security decision
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit i...
CVE-2026-111869
A vulnerability exists in makeplane plane (up to version 1.4.2) affecting an unknown function within the API Endpoint component. The flaw stems from reliance on untrusted inputs in a security decision when processing the X-Forwarded-For argument. This issue allows for a remote attack vector. Whil...
CVE-2026-111869: Reliance on Untrusted Inputs in a Security Decision
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit i...
Microsoft PowerShell 7.4.x < 7.4.21 / 7.5.x < 7.5.12 / 7.6.x < 7.6.7 RCE (macOS)
The version of Microsoft PowerShell installed on the remote macOS host is 7.4.x prior to 7.4.21, 7.5.x prior to 7.5.12, or 7.6.x prior to 7.6.7. It is, therefore, affected by a remote code execution vulnerability. Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows ...
EUVD-2026-102445
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fixed NULL pointer dereferencing when printing devname When larbdev is NULL in the case I encountered, the node is incorrectly set as iommu = &iommu NUM, it will cause devicelinkadd to fail and the kernel to crash...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted inputs in the WebUI of Google Chrome before version 150.0.7871.47 allowed a remote attacker to leak cross-origin data through malicious network traffic. Chromium security severity: Medium...
Astra Linux – Vulnerability in Python-Django
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uritoiri is susceptible to a potential Denial-of-Service DoS attack due to certain inputs containing a very large number of Unicode characters...
Astra Linux – Vulnerability in poppler, poppler-22
A floating-point exception in the PSStack::roll function of Poppler before version 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files...
