CVE-2025-62950-PoC

Descrizione Questa proof of concept PoC descrive una vulnerabilità di Cross-Site Request Forgery CSRF trovata nel plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. Il problema consente a un attaccante di ingannare un utente autenticato affinché esegua una richiesta...

CVE-2023-2591

CVE-2023-2591: Stored HTML Injection in Item Label in Teampass 3.0.6 - M Nadeem Qazi Recentemente ho identificato una vulnerabilità di sicurezza in nilsteampassnet/teampass, un popolare strumento di gestione delle password. Questa vulnerabilità, identificata come CVE-2023-2591, è un'iniezione HTM...

CVE-2025-47176

CVE-2025-47176 PoC Browser Bridge Beschreibung Dieser Proof-of-Concept PoC demonstriert die Simulation der Sicherheitslücke CVE-2025-47176. Er injiziert ein manipuliertes E-Mail-Element in Outlook, das einen bösartigen Synchronisierungspfad enthält, der beim Scannen eine Aktion auslöst. WICHTIG:...

CVE-2026-55624

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...

EUVD-2026-65513

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...

CVE-2026-55624

MintyItanium Lost-Auction is an auction plugin for Minecraft servers. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8 , players could take items such as barrier blocks or duplicate items from the search GUI, representing an integrity issue with a CVSS 4.0 base score of 5.3 (Medium) . The...

CVE-2026-55624 MintyItanium Lost-Auction takes items like barrier blocks out from search GUI

MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...

Mythic-Macro-Generator

Mythic-Macro-Generator Script Python3 per generare macro di MS Office per lanciare payload JXA di Mythic. Questo script genera una macro di Office che utilizza osascript per scaricare ed eseguire il payload JXA .js di Mythic. Passaggi: 1. Configura il server C2 Mythic e genera un payload jxa...

CVE-2023-3009

CVE-2023-3009 आइटम नाम पर स्टोर्ड XSS - TeamPass 3.0.9 में CVE-2023-2516 को बायपास करना - M Nadeem Qazi द्वारा विवरण यह रिपॉजिटरी nilsteampassnet/teampass एप्लिकेशन में खोजी गई स्टोर्ड XSS भेद्यता को संबोधित करती है, जिसे CVE-2023-2516 पहचानकर्ता सौंपा गया था। इस भेद्यता का फायदा उठाने के लिए, एक...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

Academy LMS 6.0 - Cross-Site Scripting

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. id: CVE-2023-38964 info: name: Academy LMS 6.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Creative Item Academy LMS 6.0 was discovered to...

CVE-2025-56771

الوصف أثناء تحليل موقع ecodotempo.com.br، تم اكتشاف ثغرة تخزين XSS Cross-Site Scripting. تسمح هذه الثغرة للمهاجم بحقن نصوص برمجية ضارة في الحقول التي يتم عرضها لاحقًا لمستخدمين آخرين دون تنقية مناسبة، وتحديدًا على الصفحة الرئيسية للمنطقة غير المصادق عليها غير المتصلة. نقطة النهاية المتأثرة...

duckdb

Jepsen DuckDB Test Jepsen-Tests für die DuckDB-Datenbank. Läuft lokal, anstatt auf einem entfernten Cluster. Der Test startet eine Sammlung lokaler Prozesse, die eine DuckDB-Datei lokal öffnen, und interagiert mit ihnen über STDIN/STDOUT. Dies ist ein früher Prototyp. Er schaltet sich ein, führt...

libfwsi

libfwsi विंडोज शेल आइटम प्रारूप तक पहुंचने के लिए एक लाइब्रेरी है। परियोजना जानकारी: स्थिति: प्रायोगिक लाइसेंस: LGPL-3.0-or-later अधिक जानकारी के लिए देखें: परियोजना दस्तावेज़ीकरण: https://github.com/libyal/libfwsi/wiki/Home स्रोत से निर्माण कैसे करें: https://github.com/libyal/libfwsi/wiki/Build...

EUVD-2026-64412

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

PT-2026-79730

In the Linux kernel, the following vulnerability has been resolved: enic: fix tx hang reset use-after-free on device removal enic remove cancels the reset and change mtu work items but does not cancel tx hang reset. A TX timeout that fires while the device is being removed can schedule enic tx ha...

CVE-2026-74575

A flaw was found in the Thunderbolt XDomain driver of the Linux kernel. A race condition can occur during the removal of a Thunderbolt cross-domain device XDomain. This allows a delayed work item to be queued after its cancellation but before the XDomain object is freed, leading to a use-after-fr...

EUVD-2026-62947

In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface...