DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

B63-POC-CVE-2026-60004

B63-POC-CVE-2026-60004 — Gitea diffpatch RCE Verification level: VERIFIED in-container lab; command execution as the Gitea service account git demonstrated 10/10 across both exploit variants; 1.27.1 negative 0/5; 1.16.9 negative 4/4; cold rebuild 4/4 + 6/6. Produced by the b63 capability-validati...

CVE-2026-116313

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pgupgrade documentation recommends an affected vacuumdb invocation. Within major version...

CVE-2026-116313

PostgreSQL contains an untrusted search path vulnerability in the vacuumdb utility, specifically within the --missing-stats-only catalog query. This flaw allows a database owner to execute arbitrary SQL as the user running the vacuumdb process by shadowing operators. Affected versions include Pos...

CVE-2026-116313 PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pgupgrade documentation recommends an affected vacuumdb invocation. Within major version...

-CVE-2021-41962

-CVE-2021-41962 Description Cross Site Scripting XSS vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner fullname parameter in a Send Service Request in vehicleservice. Additional Information NA Vulnerability Type Cross Site Scripting XSS Vendor of Product...

Vulnerability in client (CVE-2026-116313)

PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog...

CVE-2026-76079

The governance, risk, and compliance (GRC) platform Probo is vulnerable to a vertical privilege escalation in versions prior to 0.224.0 . An attacker with organization ADMIN privileges can bypass the owner-only authorization gate to mint an OWNER membership using the createUser function. This fla...

CVE-2026-76079 Probo: Vertical privilege escalation

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in versi...

CVE-2026-76079 Probo: Vertical privilege escalation

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in versi...

CVE-2026-13768

CVE-2026-13768 - Gardyn IoT Hub Owner Key Exposure !WARNING This repository contains a fully functional proof-of-concept for a high-severity IoT vulnerability. This code is provided strictly for educational purposes, authorized security research, and defensive testing. Unauthorized use is illegal...

B63-POC-CVE-2026-96652

CVE-2026-96652 — Plex Media Server timeline SSRF PoC and verification material for CVE-2026-96652 GHSA-5p7w-r379-3c2m, "Plex Media Server allows SSRF via '/player/timeline'", CVSS v3.1 4.3 Medium , CWE-918 — fixed in Plex Media Server 1.43.3.10861. Overview — the /player/timeline subscription...

CVE-2026-124495

When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are...

Zygotroller

Zygotroller Remove profile owners/Family Link on ANY pre June 2024 Developer Mode device Android 12+ Zygotroller is a proof-of-concept that can remove a profile owner and associated restrictions with CVE-2024-31317's Zygote injection bug. It requires developer mode and the latest security patch t...

CVE-2024-23724

Installation Automatic installation recommended To test the vulnerability, we need two accounts: an account with the administrator role owner and an account with the contributor role. In Ghost CMS, you must first access the admin panel to create the owner account, then invite a contributor from...

CVE-2024-51032

CVE-2024-51032 Description A Cross-site Scripting XSS vulnerability in managerecipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "owner" input field. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

CVE-2026-107246

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

CVE-2026-107246

The Plesk extension "Site Import" (versions before 1.13.2 ) is vulnerable to a path traversal flaw due to improper validation of domain and session identifiers. An attacker with a non-owner subscription can redirect a privileged backend session into a directory they control. This vulnerability ca...