PT-2026-65636

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

Exploit for CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Exploit ⚠️ Disclaimer...

EUVD-2018-9808

Malware in sbrugna...

EUVD-2022-44050

Malicious code in bioql PyPI...

Arbitrary Code Injection

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Arbitrary Code Injection via the /locales/locale.json endpoint when processing the locale and namespace query parameters. An attacker can execute arbitrary code on the server by sending...

CVE-2022-40784

Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406...

CVE-2022-40784

Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406...

CVE-2022-40784

Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406...

Stack overflow

Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406...

CVE-2022-40785

Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code execution on cameras running the firmware when a victim logs into a specially crafted mobile app...

Remote code execution

Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code execution on cameras running the firmware when a victim logs into a specially crafted mobile app...

CVE-2022-40784

CVE-2022-40784 affects mIPC camera firmware version 5.3.1.2003161406. The issue is an unlimited strcpy on user input when setting a locale file, which leads to a stack buffer overflow. CVSS v3.1 metrics indicate a high severity (8.8) with network attack vector, low attack complexity and low privi...

CVE-2022-40784: Out-of-bounds Write

Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406...

CVE-2022-40785: Improper Neutralization of Special Elements used in an OS Command

Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code execution on cameras running the firmware when a victim logs into a specially crafted mobile app...

EulerOS Virtualization 2.10.1 : babel (EulerOS-SA-2022-1367)

According to the versions of the babel package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via...

python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code

A flaw was found in python-babel. A path traversal vulnerability was found in how locale data files are checked and loaded within python-babel, allowing a local attacker to trick an application that uses python-babel to load a file outside of the intended locale directory. The highest threat from...

WordPress WPML plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation of a set of PHP language development of the blogging platform, the platform supports PHP and MySQL servers to set up a personal blog site. WPML also known as sitepress-multilingual-cms is used in one of the multi-language support plug-ins. A cross-si...

CVE-2018-18069

processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...

PT-2018-14332

Name of the Vulnerable Software and Affected Versions WPML plugin versions prior to 3.6.4 Description The issue concerns an XSS vulnerability. It can be exploited via any locale file name parameter, such as locale file name en, in an authenticated theme-localization.php request to...

DEBIAN-CVE-2010-0393

The cupsGetlang function, as used by lppasswd.c in lppasswd in CUPS 1.2.2, 1.3.7, 1.3.9, and 1.4.1, relies on an environment variable to determine the file that provides localized message strings, which allows local users to gain privileges via a file that contains crafted localization data with...