CVE-2023-43149

CVE-2023-43149 लेखक : Aitor Herrero Fuentes विक्रेता: SPA-Cart विक्रेता होमपेज: https://spa-cart.com/ सॉफ्टवेयर लिंक: https://demo.spa-cart.com/admin संस्करण: 1.9.0.3 परीक्षित पर: Windows 10 Pro CSRF मूल खाता जोड़ें क्रॉस साइट रिक्वेस्ट फोर्जरी कमजोरी एप्लिकेशन demo.spa-cart.com में एक दूरस्थ...

openclaw-vuln-report

OpenClaw-Schwachstellenanalysebericht CVE-2026-25253 Sicherheitslücke – chinesische Erläuterung Online lesen GitHub Pages: https://joseph19820124.github.io/openclaw-vuln-report/ Schwachstellenübersicht CVE : CVE-2026-25253 Bewertung : CVSS 8.8 hoch Typ : Cross-Site WebSocket-Hijacking Auswirkung ...

CVE-2025-63848

CVE-2025-63848 swish-prolog cve Eine Stored-Cross-Site-Scripting-Schwachstelle XSS in SWISH Prolog bis Version 2.2.0 ermöglicht es Angreifern, beliebigen Code über ein manipuliertes Web-IDE-Notebook auszuführen. Auswirkungen Kontoübernahme mit einem Klick. Gegenmaßnahmen Führen Sie ein Upgrade au...

RootMyVivo

RootMyVivo 🛡️ Root con un clic per dispositivi vivo/iQOO con bootloader bloccato. Basato su CVE-2026-43499 GhostLock + KernelSU. Come funziona 1. Rileva automaticamente modello e versione del kernel 2. Scarica il payload appropriato da RootMyVivo-Payloads 3. Esegue l'exploit LDPRELOAD / binary...

CVE-2021-30862

CVE-2021-30862 Em 2021, CodeColorist publicou seus artigos sobre as vulnerabilidades Mistuned, uma série de vulnerabilidades que afetam a iTunes Store, permitindo execução remota de código com um clique. Notavelmente, ele demonstrou como fazer o "pop calc" sem qualquer corrupção de memória, apena...

netgear-pwnagent

PwnAgent यह CVE-2023-24749 का PoC है, जिसे PwnAgent भी कहा जाता है, जो Netgear RAX राउटर्स में एक-क्लिक WAN-साइड RCE है। आप http://pwn.mahaloz.re पर जाकर इस एक्सप्लॉइट को ट्रिगर कर सकते हैं। स्पष्टीकरण कृपया यहाँ दिए गए ब्लॉग पर जाएँ, जो इसकी व्याख्या करता है।...

EUVD-2026-53358

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click...

EUVD-2026-51548

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

VPS.org one-click deployment templates contain multiple vulnerabilities

Overview VPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures. Description VPS.org is a cloud and virtual private server hosting provider that offer...

PT-2026-66762

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

TencentOS Server 3: evince (TSSA-2026:0620)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0620 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2026-58870

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The Grav Login plugin allows a top-level GET request to be sent to the task URI parameter via the TaskServiceProvider without requiring a login-form nonce, an Origin check, or a Referer...

CVE-2026-53662 immich: One-click account takeover via XSS in login page continue redirect

immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting XSS vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The contin...

EUVD-2026-36666

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/oneclickupgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched...

CVE-2026-12187

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/oneclickupgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched...

CVE-2026-12187

CVE-2026-12187 affects GL.iNet GL‑MT3000 devices running firmware up to 4.4.5. The vulnerability is in an unknown function of the /usr/bin/one_click_upgrade component (Online Firmware Upgrade Handler) that allows remote command injection. Public disclosure and PoC details are indicated; exploitat...

Microsoft Fixes One-Click GitHub Dev Attack That Let Attackers Steal OAuth Tokens

Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code VS Code that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

The CVE-2026-9101 entry describes a prototype pollution flaw in CSV parsing during import. The underlying issue can allow untrusted file paths (not arguments) to reach shell.openExternal after specific user actions, potentially enabling a limited form of “1-click” command execution. Documents do ...