28154 matches found
CVE-2026-72960
Windows Media Player is affected by a heap-based buffer overflow that allows an unauthorized, remote attacker to achieve code execution over a network . The attack requires user interaction (e.g., opening a crafted media file), but no prior privileges or elevated complexity. The assigned CVSS 3.1...
Windows Media Player Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network...
Windows Media Player Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network...
CVE-2018-4878
CVE-2018-4878 POC CVE-2018-4878은 TEMP.Reaper가 야생에서 악용하는 것이 처음으로 입증된 취약점입니다. 이 저장소에는 분석된 악성코드로부터 작성한 POC가 포함되어 있으며, Use-After-Free 취약점을 악용하여 32비트 버전의 Flash 27에서 작동하는 것으로 알려져 있습니다. 성공적인 악용 시 공격자에게 프로세스 메모리를 수정할 수 있는 ByteArray 객체를 제공합니다. 취약점에 대한 전체 분석은 여기에서 확인할 수 있습니다...
unknownpwn.github.io
Tecnovision LED 비디오 월 취약점 및 익스플로잇. SQLi에서 전체 루트 액세스까지. 소개: Tecnovision은 경기장예: Twickenham Stadium, 콘서트홀, 쇼핑몰, 도로 표지판 등에 사용되는 LED 비디오 월 제조업체입니다. DlxSpot Player 4는 이러한 일부 LED 월을 제어하는 소프트웨어 컨트롤러입니다. 아래는 제가 발견한 패치되지 않은 익스플로잇으로, SQLi에서 전체 루트 액세스로 이어졌습니다하하!. 하드코딩된 비밀번호가 마지막 발견 항목이라는 점에 유의하세요. 단지 할당된 CVE...
CVE-2022-51008
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
CVE-2022-51008 PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
CVE-2022-51008 PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
EUVD-2022-56035
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
CVE-2022-51008
PocketMine-MP versions prior to 4.12.3 are vulnerable to a denial-of-service via unauthenticated session exhaustion. The server fails to limit connections that have not yet completed authentication, so an attacker can flood it with connections that occupy max-player slots without ever sending a L...
CVE-2022-35978-POC
CVE-2022-35978 POC Описание CVE-2022-35978 — это критическая уязвимость безопасности, затрагивающая версии Minetest до 5.5.1 включительно. Minetest — это бесплатный игровой движок с открытым исходным кодом на основе вокселей, который поддерживает простое создание модов и игр. В режиме одиночной...
CVE-2026-84937
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-84937
CVE-2026-84937 affects the Video Player for YouTube WordPress plugin in versions before 2.1.0 . The root cause is improper sanitisation and escaping of user-supplied input before it is used in a SQL statement, specifically via the ytp_ajax endpoint. Users with the Contributor role or above can ex...
WordPress Video Player for YouTube plugin < 2.1.0 - Contributor+ SQLi vulnerability
Contributor+ SQLi vulnerability discovered by Artus KG in WordPress Plugin YT Player versions 2.1.0...
PT-2026-86449
CVE-2026-36433 — Arbitrary code execution in Actions Semiconductor Media Player Utilities v.4.46 No signature. No checksum. No auth. Their own firmware update toolkit Production.dll + RdiskUpgrade.exe accepts any firmware you hand it over USB. https://t.co/meTetZ91W1 CVE...
PT-2026-86360
🚨 CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-81289 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...
CVE-2026-81289
CVE-2026-81289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, affecting versions 5.13.1 and earlier . The vulnerability requires user interaction (victim must visit a crafted page) but needs no prior au...