PT-2026-116017

CoAI Chat Nio through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated...

CVE-2026-84823

A flaw was found in WildFly. A user with the Monitor role, which is the lowest standard Role-Based Access Control RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an...

THM-Vulnerability_Capstone-CVE-2018-16763

THM-VulnerabilityCapstone-CVE-2018-16763 A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763. CREDITS I do not take credit for the discovery of this vulnerability. Thank you to the following people. Vulnerability Discovery: 0xd0ff9 TryHackMe Room & Author:...

THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287 Credits I take no credit for the original discovery and exploitation of this vulnerability. Thank you to the following people! Discovery: Daniele Linguaglossa Metasploit Module...

CVE-2026-104150

A flaw was found in AdonisJS HTTP Server. An unauthenticated remote attacker could cause a Denial of Service DoS by sending an HTTP request containing a specially crafted route parameter. Due to an inefficient regular expression in the slug route matcher, evaluating the input causes excessive CPU...

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Summary In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a...

CVE-2026-111233

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...

CVE-2026-111168 LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/uuid serves it inlin...

CVE-2026-111168 LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/uuid serves it inlin...

EUVD-2026-102345

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...

CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...

CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...

CVE-2026-111233

Netgate pfSense CE versions 2.7.1 through 2.9.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the firewall_rules.php component. The root cause is the handling of an unencoded if parameter , which allows remote attackers to inject scripts. If the non-default Require Fir...

CVE-2026-111233

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...

WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter vulnerability

Unauthenticated Privilege Escalation to 'role' Parameter vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Profile Builder versions = 4.0.3...

WordPress My Calendar plugin <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute vulnerability discovered by daroo in WordPress Plugin My Calendar versions = 3.8.7...

CVE-2026-77470

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-102527

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

WordPress PilotPress plugin <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin PilotPress versions = 2.0.43...

WordPress Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation to 'reset-view' Parameter vulnerability discovered by elaprendiz1927 in WordPress Plugin Nexter Extension versions = 4.7.11...