CVE-2025-66956

CVE-2025-66956 Control de Acceso Inseguro en los componentes de Contact Plan, E-Mail, SMS y Fax en Asseco SEE Live 2.0 permite a atacantes remotos acceder y ejecutar archivos adjuntos mediante una URL calculable. Vectores CVSS CVSS 3.1: 9.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS 4.0:...

PT-2026-89385

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live:: getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

Network-Detection-Engine

version: 0.001 网络检测引擎 root@kitploit: 一款轻量级的“网络入侵检测引擎”，可捕获实时流量并实时检测真实世界的实时攻击。（Zig0.15.2）。 特性 root@kitploit: - 使用libpcap进行实时数据包捕获 - 自定义数据包解析： - 以太网 - IPv4 - TCP / UDP / ICMP - 攻击检测： - SYN洪水检测 - ICMP洪水检测 - TCP/UDP端口扫描检测 - 死亡之Ping（Ping of Death） - 基于特征的检测： - SQL注入（UNION, DROP, 1=1） - 跨站脚本（XSS） - 命令注入...

CVE-Disclosures

Divulgaciones de CVE Este repositorio contiene avisos de seguridad y divulgaciones de vulnerabilidades investigadas y reportadas por Sahil Arya. Lista de CVEs CVE-2025-70336 — PodcastGenerator 3.2.9 XSS Almacenado Elementos en Vivo...

CVE-2026-81640

Softish C6 Ear Camera and its companion EarVision Android application are affected by a use of hard-coded credentials vulnerability (CVSS 3.1: 8.8 HIGH ). An attacker in an adjacent network position, with low complexity , no privileges required , and no user interaction , can derive the camera's ...

CVE-2026-81330 Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information

The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless ran...

cve-2015-3456

Experimentos relacionados con CVE-2015-3456 Hay: exploit/ es un "exploit" solo hace fallar a QEMU. mock/ contiene una versión reducida de QEMU. Solo queda la vulnerabilidad. patch/ contiene un programa para parchear una instancia en ejecución de QEMU. El punto principal es no necesitar símbolos d...

CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2020-24088

CVE-2020-24088 Escalada de Privilegios en Windows Se descubrió un problema en la rutina MmMapIoSpace del Foxconn Live Update Utility 2.1.6.26, que permite a atacantes locales escalar privilegios. Enlace CVE - https://vulners.com/cve/CVE-2020-24088...

EUVD-2026-70734

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize via Live NamedNodeMap Removal Skip...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

CVE-2026-86728

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86720

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...

CVE-2026-86718

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

EUVD-2026-72864

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86728 AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86728

AVideo through version 29.0 contains an authentication bypass vulnerability in the plugin/PlayLists/epg.json.php endpoint. Unauthenticated attackers can request the endpoint with sequential user or playlist IDs to retrieve live-stream keys , private EPG schedules , sensitive credentials, and serv...

CVE-2026-86728 AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86727

AVideo through version 29.0 is affected by an information disclosure vulnerability in plugin/Live/stats.json.php . The endpoint is accessible without authentication and returns a hidden_applications array in its JSON response, allowing unauthenticated attackers to retrieve stream keys and m3u8 UR...

CVE-2026-86727 AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...