CVE-2025-51820

CVE-2025-51820 A critical Remote Code Execution RCE vulnerability CVE-2025-51820 has been discovered in the Shopping Portal v1.0. 🚨 Remote Code Execution in Online Shopping Portal Project v1.0 CVE-2025-51820 🔍 Introduction In today’s digital world, Remote Code Execution RCE remains one of the mos...

firehol

FireHOL http://firehol.org/ root@kitploit: FireHOL, an iptables stateful packet filtering firewall for humans! FireQOS, a TC based bandwidth shaper for humans! Git These instructions are for people who are working with the git repository. There are more general instructions starting with Upgrade...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2023-42426

CVE ID: CVE-2023-42426 Vulnerability Type: Cross-Site Scripting Description: Cross-site scripting XSS vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component. Steps to reproduce: 1. Select the...

CVE-2024-3105-PoC

CVE-2024-3105 PoC The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

CVE-2026-88052

Tesseract is an open-source OCR engine. In versions 5.5.3 and earlier , the function UNICHARSET::load_via_fgets (in src/ccutil/unicharset.cpp) uses a declared unichar count as a loop bound and indexes into the unichars vector with an unchecked id. Because unichar_insert_backwards_compatible can l...

CVE-2026-88052 Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::loadviafgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unicharinsertbackwardscompatible can leave the vector unchanged...

By-Poloss..-..CVE-2017-20251

CVE-2017-20251: Insert PHP Plugin PHP Code Injection Vulnerability Title Unauthenticated PHP Code Injection via Shortcode Processing in Insert PHP Plugin Basic Information...

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

CVE-2026-82023

LearnPress WordPress Plugin versions before 4.4.6 are affected by a broken object-level authorization (BOLA) vulnerability in the question answer insert code path. The root cause is a missing ownership check that fails to verify whether the question belongs to the authenticated user. An attacker ...

CVE-2026-82745

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

CVE-2026-82745

ash (an Elixir data-layer framework) is vulnerable to improper access control in its ETS and Mnesia data layers. Unlike the SQL data layer, these layers implemented create as a keyed insert that silently replaces any existing entry sharing the same primary key, rather than enforcing uniqueness. A...

EEF-CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Summary Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate...

EUVD-2026-41144

Silverstripe Framework: Possible XSS attack through media embed...

Astra Linux – Vulnerability in cyrus-sasl2

In Cyrus SASL 2.1.17 through 2.1.27 up to 2.1.28, the plugins/sql.c file does not escape the password used in SQL INSERT or UPDATE statements...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed an off-by-one error in the dosplit function. Syzkaller identified a use-after-free issue in ext4insertdentry, which was caused by out-of-bounds accesses due to incorrect splitting in dosplit. BUG: KASAN: Use-after-fre...

Astra Linux – Vulnerability in cjson

It has been discovered that cJSON v1.7.16 contains a segmentation violation due to the use of the cJSONInsertItemInArray function in the cJSON.c library...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fixed a general protection fault in nilfsbtreeinsert If nilfs2 reads a corrupted disk image and attempts to read a b-tree node by calling nilfsbtreegetblock against an invalid virtual block address, it returns -ENOENT...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fixed a memory leak when insertoldidx failed. The following process will cause a memory leak for the copied znode: dirtycowznode zn = copyznodec, znode; err = insertoldidxc, zbr-lnum, zbr-offs; if unlikelyerr return...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Additional debug information will be output if an inline backref cannot be found. BUG Syzbot reported several warnings that were triggered within the function lookupInlineExtentBackref. CAUSE As usual, the reproducer of th...