The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

CVE-2025-57833

Django FilteredRelation Alias SQL 주입 취약점CVE-2025-57833 Django에서 1년 만에 터진 SQL 주입 취약점으로, 대략 보면 별칭alias으로 인한 주입입니다 어차피 별칭은 사전 컴파일이 불가능하기 때문입니다 이 취약점은 Django 프레임워크의 FilteredRelation 기능에 영향을 미칩니다. QuerySet.annotate 또는 QuerySet.alias 메서드를 사용하고 Python의 딕셔너리 확장kwargs을 통해 열 별칭을 제공할 때 SQL 주입 위험이 존재합니다. 이는...

CVE-2023-33253

CVE-2023-33253 LabCollector 6.0부터 6.15는 원격 코드 실행을 허용합니다. 인증된 원격 저권한 사용자는 실행 가능한 PHP 파일을 업로드하고 시스템 명령을 실행할 수 있습니다. 이 취약점은 message 함수에 있으며, 전송되는 파일예: shell.jpg.php.shell에 대한 검증 부족으로 인해 발생합니다. Windows Server 2019 x64에서 테스트되었습니다. 사용 방법: python CVE-2023-33253 -t 127.0.0.1 -u user -p user PoC:...

CVE-2026-14382

CVE-2026-14382 Триггер бинарного файла Исправление ошибки root@kitploit: $250000492218546 High CVE-2026-14382: Insufficient validation of untrusted input in ANGLE. Reported by anonymous on 2026-03-13 Коренная причина этой уязвимости, по-видимому, аналогична CVE-2025-6558. Исходя из моего текущего...

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect

The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. id: CVE-2024-0250...

Travelpayouts <= 1.1.16 - Open Redirect

The plugin is vulnerable to Open Redirect due to insufficient validation on the travelpayoutsredirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. id: CVE-2024-0337...

CVE-2024-9932

CVE-2024-9932 Wux Blog Editor = 3.0.0 - Неавторизованная произвольная загрузка файлов Описание: Плагин Wux Blog Editor для WordPress уязвим для произвольной загрузки файлов из-за недостаточной проверки типов файлов в функции 'wuxbtinsertImageNew' в версиях до 3.0.0 включительно. Это позволяет...

CVE-2024-53345

CVE-2024-53345 Car Rental Management System 버전 1.0 1.3의 치명적 제로데이 취약점 설명: Car Rental Management System버전 1.0 1.3의 시스템 설정 모듈 파일 업로드 기능에 치명적인 취약점이 존재합니다. 이 취약점으로 인해 낮은 권한의 사용자가 PHP 스크립트 등 실행 가능한 파일을 포함한 임의의 파일을 업로드할 수 있습니다. 이는 부적절한 파일 형식 검증과 업로드 디렉토리에 대한 접근 제어 미흡으로 인해 발생하며, 공격자는 악성 파일을 업로드한 후 인증 없이...

EUVD-2026-76137

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...

EUVD-2026-76063

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-Уязвимость-SQL-инъекции Автор эксплойта: ugurkarakoc Домашняя страница вендора https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Ссылка на программное обеспечение https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Обзор...

CVE-2026-79592

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

DEBIAN-CVE-2026-79592

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

EUVD-2026-75402

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces...

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory l...

CVE-2026-79592

An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 , caused by insufficient validation of file-controlled OLE summary offsets. The CVSS 3.1 score is 7.5 (HIGH) with a network attack vector, low complexity, no privileges required, no user interaction, and ...

PT-2026-89261

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-79592

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

CVE-2026-86776

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consu...