CVE-2025-60375

CVE-2025-60375 CVE-2025-60375 — تجاوز مصادقة / تحكم غير صحيح في الوصول في PerfexCRM ملاحظة: الخطوات أعلاه هي خطوات الاكتشاف الأصلية التي أبلغ بها Ajansha Shankar و Ahamed Yaseen. المراجع ورقة OWASP التفصيلية للمصادقة — إرشادات حول التحقق من جانب الخادم وضوابط المصادقة...

CVE-2024-9707

CVE-2024-9707 Hunk Companion = 1.8.4 - نقص الترخيص يؤدي إلى تثبيت/تفعيل إضافات عشوائية بدون مصادقة الوصف إضافة Hunk Companion لووردبريس معرضة لتثبيت/تفعيل إضافات غير مصرح به بسبب نقص فحص الصلاحية على نقطة نهاية REST API /wp-json/hc/v1/themehunk-import في جميع الإصدارات حتى الإصدار 1.8.4. وهذا يتي...

[SECURITY] [DSA 6478-1] starlette security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6478-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 30, 2026 https://www.debian.org/security/faq -...

pmg v0.27.0

Package Manager Guard PMG Block malicious npm and pip packages before they install. Defense in depth for the package managers you already use. Why PMG? Developers and AI coding agents install packages every day. Each npm install or pip install executes thousands of lines of code that nobody...

Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240

Bludit Bruteforce Mitigation Bypass Script Overview This script is a refurbished Bash implementation of an exploit targeting the Bludit CMS version = 3.9.2. It leverages a vulnerability CVE-2019-17240 that allows brute-forcing passwords by bypassing the CSRF token-based protection. The original...

[SECURITY] [DLA 4761-1] libnet-dns-perl security update

Debian LTS Advisory DLA-4761-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 30, 2026 https://wiki.debian.org/LTS Package : libnet-dns-perl Version : 1.29-1+deb11u1 1.36-1+deb12u1 CVE ID : CVE-2026-64194 Debian Bug : 1142503 Steffen Ullrich discovered that...

CVE-2025-65672

CVE-2025-65672 Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows unauthorized share and invite access to course settings. Affected Product: ClassroomIO Affected Version: 0.1.13 Discovered by: Rivek Raj Tamang RivuDon, Sikkim, India Vulnerability Details Insecure Direct Object...

CVE-2026-1337

CVE-2026-1337 - Neo4j - حقن السجلات يمكن لمستخدم مصادق عليه حقن السجلات في query.log الخاص بـ Neo4j عندما يكون Neo4j غير مُهيأً بصيغة json. ملخص لا يقوم Neo4j بإفلات أحرف التحكم في حقل البيانات الوصفية لمعاملة bolt. يمكن لمستخدم مصادق عليه إرسال أحرف تحكم بهدف حقن إدخالات سجل مزيفة عبر حقن أسطر...

CVE-2020-17456

Description On August 21, 2020, seown SLC 130 router was exposed to have an authentication rce vulnerability. The vulnerability number is cve-2020-17456. The vulnerability is due to the ping command injection in the router's Web service diagnosis function. Combined with several groups of hard cod...

CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

EUVD-2026-68286

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636

ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...

EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash\graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.query\complexity/3 multiplies child...

CVE-2025-65681

CVE-2025-65681 An issue was discoverd in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks. Discovered by - Rivek Raj Tamang RivuDo...

CVE-2025-2294

CVE-2025-2294 - إضافة Kubio AI Page Builder لـ WordPress = 2.5.1 - استغلال تضمين الملفات المحلي LFI نظرة عامة تؤثر CVE-2025-2294 على إضافة Kubio AI Page Builder لـ WordPress الإصدارات حتى 2.5.1 ضمنًا. تعاني من ثغرة تضمين الملفات المحلي LFI بدون مصادقة عبر دالة thekubiohybridthemeloadtemplate. تسم...

CVE-2025-65669

CVE-2025-65669 An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India...

xuxueli__xxl-job_CVE-2020-29204_2-2-0

root@kitploit: XXL-JOB XXL-JOB, un framework de planification de tâches distribuées. -- Page d'accueil --...

ttddbg

ttddbg - Time Travel Debugging IDA plugin ⚠️ Attention IDA 8 users: using ttddbg with IDA 8 require a work-around for the moment, seeKnown issues This plugin adds a new debugger to IDA which supports loading Time Travel Debugging traces generated using WinDBG Preview. This plugin supports both x86...