CVE-2022-45472

CVE-2022-45472 DOM Based XSS البرنامج: CAE Learning Space Enterprise مع ترخيص Intuity إصدار الصورة: 267r مستوى التصحيح: 639 الثغرة: DOM Based XSS الوصف برنامج إدارة CAE Learning Space Enterprise عرضة لهجوم XSS المستند إلى DOM. هجوم XSS المستند إلى DOM هو عندما يرسل المستخدم حمولة منفذة إلى المضيف...

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit

Microsoft-Office-Word-MSHTML-Exploit-d'exécution-de-code-à-distance CVE-2021-40444 EXPLOIT À UTILISER DANS METASPLOIT, PERMET AUX ATTAQUANTS D'OBTENIR UNE EXÉCUTION DE CODE À DISTANCE VIA MICROSOFT OFFICE WORD EN INJECTANT UN CODE MALVEILLANT DANS LE FICHIER...

CVE-2024-3094-info

CVE-2024-3094-infos https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - réponse de Lasse Collin https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

EUVD-2025-211030

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CVE-2025-15591 Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CVE-2025-15591

A Cross-Site Scripting (XSS) vulnerability exists in the Forums feature of OpenText Content Management Content Server . This flaw allows a bad actor to inject malicious code into a Forums web page. The vulnerability is associated with CWE-79 (Improper Neutralization of Input During Web Page Gener...

CVE-2024-3094_xz_check

CVE-2024-3094 Script de vérification xz Ce dépôt contient un script Bash et une commande en une ligne pour vérifier si un système exécute une version vulnérable de l'utilitaire « xz », comme spécifié par CVE-2024-3094. Voir la description et l'énoncé d'impact ci-dessous, d'après les informations...

Malicious code in thurdweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7 Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RichEditor field when it is disabled, as its state is rendered without sanitizing HTML content. An attacker can execute arbitrary HTML or JavaScript in the context of users viewing the form by injecting...

Keras 路径遍历漏洞

Keras is an open-source deep learning framework developed by Keras. Versions of Keras prior to 3.14.0 contained a path traversal vulnerability. This vulnerability stemmed from a path traversal issue in the archive extraction tool. The functions filtersafetarinfos and filtersafezipinfos used to...

CVE-2026-34926: Relative Path Traversal

A directory traversal vulnerability in the Apex One on-premise server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex...

Attackers adopt JavaScript runtime Bun to spread NWHStealer

In our previous research, we analyzed a Windows infostealer we track as NWHStealer. The attackers behind this stealer are continuously finding new methods to distribute the stealer. During our hunting activities, we noticed how attackers are using a JavaScript runtime called Bun to help distribut...

EUVD-2019-20087

Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view...

PT-2026-28466

Name of the Vulnerable Software and Affected Versions Home Assistant versions 2020.02 through 2026.01 Description Home Assistant, an open-source home automation software, contains a flaw where an authenticated user can inject malicious code into a device entity name. This allows for Cross-Site...

CVE-2026-20116 Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities

A vulnerability in the web-based management interface of Cisco Finesse, Cisco Packaged Contact Center Enterprise Packaged CCE, Cisco Unified Contact Center Enterprise Unified CCE, Cisco Unified Contact Center Express Unified CCX, and Cisco Unified Intelligence Center could allow an unauthenticate...

EUVD-2020-30957

Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in C:\Program Files x86\Outline to inject malicious code that would execute with...

CVE-2021-47770: Improper Control of Generation of Code

OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network...

CVE-2022-38625

Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position i...

CVE-2022-26947

Archer 6.x through 6.9 SP3 6.9.3.0 contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...

CVE-2021-27602

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the...