252745 matches found
CVE-2026-85484 HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping
HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element...
CVE-2024-48990-PoC-Testing
CVE-2024-48990-PoC-Testing 🐍🔓 该仓库包含一个概念验证 PoC ，用于演示needrestart程序中的一个漏洞，该程序未能正确设置Python路径，可能导致权限提升。该PoC突显了通过利用此缺陷获取提升权限的潜在途径。 ⚠️ 漏洞概述 CVE-2024-48990 漏洞存在于 needrestart 包中。具体来说，它未能正确设置 Python 路径，在特定操作触发时可被利用来提升权限。 该 PoC 模拟了一个场景：通过 Python 加载恶意共享库，操纵系统设置并获取提升的权限。请仅在受控、安全的环境中进行测试。 要检查你是否易受攻击，请运行：...
CVE-2026-19872 HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...
CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...
OpenSSL_1_0_1g_CVE-2015-1788
OpenSSL 1.0.1g 7 Apr 2014 版权所有 c 1998-2011 OpenSSL 项目 版权所有 c 1995-1998 Eric A. Young、Tim J. Hudson 保留所有权利。 描述 OpenSSL 项目是一项协同努力，旨在开发一个健壮、商业级、功能齐全的开源工具包，实现 安全套接字层（SSL v2/v3）和传输层安全（TLS v1）协议，以及一个功能强大的通用密码学库。 该项目由全球志愿者社区管理，他们使用 互联网进行沟通、规划和开发 OpenSSL 工具包及其 相关文档。 OpenSSL 基于优秀的 SSLeay 库，该库由 Eric A. You...
CVE-2026-86808 moltis-org moltis vault.rs vault_recovery_handler missing authentication
A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vaultunlockhandler/vaultrecoveryhandler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been...
go-zeek-broker-ws
用于 Golang 的 Zeek Broker websocket 接口库 该库实现了 Zeek Broker websocket 接口。 提供了在 Zeek 和 Go 类型之间进行合理映射的辅助函数。 用法 该库包含两个包： encoding encoding 对用于表示 Zeek 类型的递归 JSON 数据结构（Data 结构体）以及 Zeek 事件和错误消息的 Broker 编码（DataMessage 结构体）进行了建模。这些结构可以直接使用（在某些情况下必须直接使用，参见下一节中的订阅示例），但一些辅助函数使构建消息更加方便。要手动构造一个 Zeek string：...
CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery
A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...
external_expat_2.1.0_CVE-2022-43680
Expat, Release 2.1.0 这是 Expat，一个用于解析 XML 的 C 语言库，由 James Clark 编写。 Expat 是一个流式 XML 解析器。这意味着你需要在开始解析之前向解析器注册处理器。当解析器在文档中发现相关结构时，这些处理器会被调用。开始标签就是你可以为其注册处理器的结构类型之一。 Windows 用户应使用 expatwin32bin 包，其中包含预编译的库和可执行文件，以及供开发者使用的源代码。 Expat 是自由软件。你可以根据本包中 COPYING 文件所含许可证的条款复制、分发和修改它。该许可证与 MIT/X Consortium...
CVE-2025-32463_Exploit
CVE-2025-32463Exploit Affected versions 1.9.14 to 1.9.17 root@kitploit: bash run.sh Success as follows root@kitploit: neko@aosc-neko205 CVE-2025-32463Exploit@main $ bash run.sh + CVE-2025-32463 Sudo chroot 漏洞复现脚本 正在创建临时工作目录... 工作目录已创建: /tmp/sudoexploit.nc0EjT 正在创建 C 语言 payload woot1337.c... 正在设置...
CVE-2026-81353
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally...
CVE-2026-81352
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network...
CVE-2026-69775
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges over a network...
CVE-2026-69276
Integer underflow wrap or wraparound in Microsoft UxTheme Library uxtheme.dll allows an unauthorized attacker to execute code over a network...
CVE-2026-58600
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally...
CVE-2026-58599
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
cryptography
pyca/cryptography .. image:: https://img.shields.io/pypi/v/cryptography.svg :target: https://pypi.org/project/cryptography/ :alt: Latest Version .. image:: https://readthedocs.org/projects/cryptography/badge/?version=latest :target: https://cryptography.io :alt: Latest Docs .. image::...
