tesla-security-research

Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...

CVE-2021-40223

CVE-2021-40223 Application : Rittal CMC PU III Web management Devices : CMC PU III 7030.000 Software Revision : V3.11.002 Hardware Revision : V3.00 Attack type : Stored XSS Solution : Update to Software Revision V3.17.10 or later Summary : Web application fails to sanitize user input on Security...

CVE-2026-84313

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a...

CVE-2019-13633

CVE-2019-13633 Suggested description : Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. Additional Information : Blinger.io - is a platform which used by global clients such as FxPro, Alfa Bank, OneTwoTrip, Ivi, KupiVIP Group, Belavia, Wargaming, Yandex, OZON, TCS Group Holding and...

CVE-2026-85948

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...

CVE-2026-85948 Improper privilege management in Progress MarkLogic Server Management API

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...

TYPO3-XSS-POC

TYPO3-XSS-POC Typo3 -v9.1.0 Persistent Cross Site ScriptingXSS Assigned CVE Number: CVE-2018-6905...

CVE-2026-1122-IoT-Firmware-Update-Signature-Bypass-via-Low-Order-Point-Injection

5. CVE-2026-1122 – IoT Firmware Update Signature Bypass via Low‑Order Point Injection Overview An IoT device’s OTA firmware verification uses a flawed Ed25519 implementation that does not reject public keys with small‑order components, allowing an attacker to forge a valid signature for malicious...

PT-2026-110640

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.9 Description An authorization flaw exists in certain forest-management operations. A remote attacker who already possesses forest-management...

PT-2026-110468

Name of the Vulnerable Software and Affected Versions Metasploit Framework affected versions not specified Description The post module post/apple ios/gather/ios image gather contains a relative path traversal issue. The module takes file names from a Meterpreter directory listing, which can be...

CVE-2026-84313: Improper Authentication

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a...

EUVD-2026-96897

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the canonlyjoinviainvite setting. Attackers with the Raven User role can call the joinworkspace method to become persistent members, reading a...

CVE-2026-108731 Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the canonlyjoinviainvite setting. Attackers with the Raven User role can call the joinworkspace method to become persistent members, reading a...

CVE-2018-8062

CVE-2018-8062 Persistent XSS on Comtrend AR-5387un router Exploitation explanation: To exploit this vulnerability, once logged into the router, a WAN service must be created Click on "Advanced Setup", "WAN Service". "Add button", "Next" Then insert the payload into the "Enter Service Description"...

honggfuzz

Honggfuzz Un fuzzer evolutivo, orientato alla sicurezza e guidato dal feedback. Honggfuzz è un fuzzer generico che utilizza la copertura del codice basata su software e hardware per trovare bug. È multi-processo, multi-thread e supporta il fuzzing persistente per una velocità estrema...

CVE-2025-34226

CVE-2025-34226: Persistent DoS in OpenPLC Runtime Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34226 Affects| OpenPLC Runtime V3 Fixed in| commit 095ee09623dd229b64ad3a1db38a901a3772f6fc Severity| High CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N 7.1...

CVE-2020-13094

Title: Dolibarr 11.0.3 - Persistent Cross-Site Scripting Author: Mehmet Kelepce / Gais Cyber Security Date : 2020-04-14 Vendor: https://www.dolibarr.org/ Exploit-DB Author ID: 8763 Remotely Exploitable: Yes Dynamic Coding Language: PHP CVSSv3 Base Score: 7.4 AV:N, AC:L, PR:L, UI:N, S:C, C:L, I:L,...

EUVD-2026-95894

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restorenginx and restorenginxui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create an...

CLEANSTART-2026-LC49486 Security fix for GHSA-j5w8-q4qc-rx2x applied in: gcp-compute-persistent-disk-csi-driver 1.22.3-r1, cloud-provider-aws 1.34.1-r1

GHSA-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AR39396 Security fix for GHSA-f6x5-jh6r-wrfv applied in: gcp-compute-persistent-disk-csi-driver 1.22.3-r1

Security vulnerability affects the gcp-compute-persistent-disk-csi-driver package. This issue is resolved in later releases. See references for vulnerability details...