6519 matches found
kkFileView 4.1.0 - Cross-Site Scripting
kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...
mooSocial 3.1.8 - External Service Interaction
mooSocial 3.1.8 is vulnerable to external service interaction via multiple parameters in the post function. id: CVE-2023-43323 info: name: mooSocial 3.1.8 - External Service Interaction author: ritikchaddha severity: medium description: | mooSocial 3.1.8 is vulnerable to external service...
Movies <= 0.6 - Cross-Site Scripting
A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4539 info: name: Movies = 0.6 - Cross-Site Scripting author: daffainfo...
Odoo <= 8.0-20160726 & 9.0 - Open Redirect
An Open Redirect vulnerability in Odoo versions = 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL. id: CVE-2017-5871 info: name: Odoo = 8.0-20160726 & 9.0 - Open Redirect author: 1337rokudenashi severity: medium description: | An Open...
docker-confluence-patched
docker-confluence-patched Confluence 7.12.2 parcheado CVE-2021-26084...
NeDi 1.9C - Cross-Site Scripting
NeDi 1.9C is vulnerable to cross-site scripting because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a...
Cherokee HTTPD <=0.5 - Cross-Site Scripting
Cherokee HTTPD 0.5 and earlier contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. id: CVE-2006-1681 info:...
mooSocial v.3.1.8 - Cross-Site Scripting
Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. id: CVE-2023-44813 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha severity:...
Node.js st module Directory Traversal
A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...
CVE-2026-73283 affecting package openssh for versions less than 9.8p1-10
CVE-2026-73283 affecting package openssh for versions less than 9.8p1-10. A patched version of the package is available...
CVE-2026-63074 affecting package openssl for versions less than 3.3.7-6
CVE-2026-63074 affecting package openssl for versions less than 3.3.7-6. A patched version of the package is available...
CVE-2026-63072 affecting package openssl for versions less than 3.3.7-6
CVE-2026-63072 affecting package openssl for versions less than 3.3.7-6. A patched version of the package is available...
CVE-2026-63073 affecting package openssl for versions less than 3.3.7-6
CVE-2026-63073 affecting package openssl for versions less than 3.3.7-6. A patched version of the package is available...
CVE-2026-75803 affecting package openssl for versions less than 3.3.7-6
CVE-2026-75803 affecting package openssl for versions less than 3.3.7-6. A patched version of the package is available...
ROOT-OS-DEBIAN-11-CVE-2024-5642 CVE-2024-5642 in python3.9 - Patched by Root
Root has patched CVE-2024-5642 in the python3.9 package for Root:Debian:11. Multiple fixed versions available...
thymeleaf-check
thymeleaf-check ThymeleafCVE-2026-40477 / CVE-2026-41901 离线排查工具 —— 零依赖、单 jar、不联网。 两条 CVSS 9.0 的 SSTI 绕过,九天内连出两个修复版。它先回答「我中了哪几条」, 然后回答那个更难受的问题: 我这条版本线,有没有能升的修复版? 对 3.1.x ,有升到 3.1.5.RELEASE 就完事。 对 3.0.x 及更早 ,没有 —— 而那恰恰是装机面最大的一批人。 为什么需要它 两条 advisory 的受影响范围,在 OSV 里都是 introduced: 0: root@kitploit: cur...
CVE-2026-88871
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...
ROOT-OS-DEBIAN-11-CVE-2023-44487 CVE-2023-44487 in varnish - Patched by Root
Root has patched CVE-2023-44487 in the varnish package for Root:Debian:11. Multiple fixed versions available...
CVE-2026-1357-Lab
CVE-2026-1357 — WPvivid Backup & Migration Vuln vs Patched Docker Lab Local-only Docker lab for comparing WPvivid Backup & Migration: Vulnerable: 0.9.123 Patched: 0.9.124 Built for learning practice lab setup, verification, logs, notes. Anything PoC-related is intended to run only inside this lab...