CVE-2024-33299

CVE-2024-33299 Stored Cross Site Scripting vulnerability in Microweber = 2.0.9 Summary : A Stored Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users...

kadimus

kadimus LFI Scan & Exploit Tool kadimus is a tool to check for and exploit LFI vulnerabilities, with a focus on PHP systems. Features: Check all url parameters /var/log/auth.log RCE /proc/self/environ RCE php://input RCE data://text RCE expect://cmd RCE Source code disclosure Command shell...

Gxss

Project is now Deprecated as Dalfox has discovery option which can be used to identify reflecting params dalfox file urls.txt --skip-xss-scanning -o reflecting.txt Gxss v4.0 A Light Weight Tool for checking reflecting Parameters in a URL. Inspired by kxss by @tomnomnom. Installation go install...

CVE-2026-98744

A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows uninitialized values to be processed by the sound subsystem,...

PT-2026-122100

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

Exploit for Code Injection in Geoserver

CVE-2024-36401 — GeoServer OGC filter evaluation RCE PoC and...

FUEL CMS 1.4.1 - Remote Code Execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. id: CVE-2018-16763 info: name: FUEL CMS 1.4.1 - Remote Code Execution author: pikpikcu severity: critical description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/...

OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

CVE-2026-114055

A flaw was found in vLLM. A remote attacker can cause a Denial of Service DoS by supplying manipulated multimodal processing parameters with excessively large image, frame, or patch values. Because the application processes these unvalidated parameters directly, it exhausts available memory and...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Bouncy Castle for Java

Summary IBM SPSS Modeler is affected by vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with...

CVE-2024-6423

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends...

EUVD-2024-55814

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends...

CVE-2024-6423 Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends...

CVE-2024-6423

Multiple WSO2 products are affected by CVE-2024-6423 due to a failure to enforce validation constraints on user-supplied URL parameters . While the software does not actively utilize the captured data, it may accept and subsequently record sensitive information in access logs . This oversight cou...

CVE-2026-92998

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-107043

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-106864

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters...

PT-2026-120486

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-120602

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends...

CVE-2026-81212

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters...