CVE-2024-21534-poc

Vulnerability: CVE-2024-21534 Severity: Critical CVSS Score: 9.8 Description: The jsonpath-plus package versions = 10.0.7 is vulnerable to a Remote Code Execution RCE vulnerability that allows attackers to execute arbitrary code via Node.js's VM module. This vulnerability is caused by insufficien...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2026-116253

A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::RunMagicQuotes of the file plus/adjs.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotel...

EUVD-2026-109685

A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::RunMagicQuotes of the file plus/adjs.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotel...

CVE-2026-116253 DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection

A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::RunMagicQuotes of the file plus/adjs.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotel...

CVE-2026-116253

The software DedeCMS 5.7.118 is vulnerable to a code injection vulnerability within the Advertisement Rendering component. Specifically, the issue resides in the plus/ad_js.php file and involves the common.inc.php::_RunMagicQuotes function. An attacker can exploit this remotely by manipulating th...

CVE-2026-116253 DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection

A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::RunMagicQuotes of the file plus/adjs.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotel...

Zoho ManageEngine ServiceDesk Plus - Authentication Bypass

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. id: CVE-2021-37415 info: name: Zoho ManageEngine ServiceDesk Plus - Authentication Bypass author: daffainfo,jjcho severity: critical description: | Zoho...

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

Medium: nginx

Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the...

Medium: nginx

Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the...

Amazon Linux 2 : nginx (ALASNGINX1-2026-017)

The version of nginx installed on the remote host is prior to 1.30.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-017 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-113717 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-113717 Source advisory: OSV:GHSA-CX28-75Q4-X26Q...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-113714 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-113714 Source advisory: OSV:GHSA-494P-63J8-28P3...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-113718 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-113718 Source advisory: OSV:GHSA-394H-QWMC-48PF...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-113720 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-113720 Source advisory: OSV:GHSA-FC2G-4W5P-6WHM...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-113723 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-113723 Source advisory: OSV:GHSA-6W3R-XR62-4XCP...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-113715 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...