rag-seguridad

CyberRAG local — RAG over your knowledge, 100% Ollama RAG Retrieval-Augmented Generation system to query your cybersecurity notes Obsidian vault, HTB writeups, notes with natural language. Everything runs on your machine : embeddings and generation use local Ollama, with no data leaving your...

presentations

My presentations More things can be found in my personal site: https://sites.google.com/site/zhiniangpeng Exploiting preauth RCE and Sandbox escape vulnerabilities in EXSi, Typhooncon 2023 OLE object are still dangerous today — Exploiting Microsoft Office, POC 2023 Django-Simple-Captcha —...

WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting

WPZOOM Portfolio = 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request. id: CVE-2026-49069 info: name: WPZOOM Portfolio = 1.4.21 - Reflected Cross-Site...

Joomla! Portfolio Nexus - Remote File Inclusion

Joomla! Portfolio Nexus 1.5 contains a remote file inclusion vulnerability in the inertialFATE iF comifnexus component that allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2009-4679 info: name: Joomla! Portfol...

WP Projects Portfolio <= 3.0 - Cross-Site Scripting

WP Projects Portfolio with Client Testimonials WordPress plugin = 3.0 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13114...

security-portfolio

Skyler M. — Security Portfolio IT Infrastructure & Security Engineer · Offensive security · Detection engineering · Vendor risk USMC veteran · Sole IT & security owner for a 200-user firm across 23 states · Top 2% on TryHackMe LinkedIn · GitHub @Mitsu-bis · HackerOne · TryHackMe · Resume I'm a US...

classy-core (>=0.2.0.dev20211228, <=0.2.0.dev20211230), discord-py-interactions (>=4.0.0, <=4.0.1) +2 more potentially affected by CVE-2026-114134 via black (21.11.0b1)

black PYPI version 21.11.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - classy-core =0.2.0.dev20211228, =4.0.0, =0.0.4, =0.0.8 Source cves: CVE-2026-114134 Source advisory: OSV:GHSA-CG8M-R9F2-5WM2...

CVE-2026-110514

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

CVE-2026-110514

The WPZOOM Portfolio Lite WordPress plugin (versions before 1.4.34 ) contains an Authorization Bypass vulnerability (CWE-639). The application fails to verify if a user has the necessary permissions to edit a post before allowing modifications to its type and order . This flaw enables users with ...

WordPress WPZOOM Portfolio Lite plugin < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite vulnerability

Contributor+ Arbitrary Post/Page Type Overwrite vulnerability discovered by Huseyn in WordPress Plugin WPZOOM Portfolio versions 1.4.34...

CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

EUVD-2026-107068

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

EUVD-2026-106653

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Easily...

EUVD-2026-106630

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to...

PT-2026-120463

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...

Oracle Primavera P6 Enterprise Project Portfolio Management (October 2026 CPU)

The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and...

CVE-2026-91399

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Easily...

CVE-2026-91376

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to...

CVE-2026-91399

A vulnerability exists in the Web Access component of Oracle Construction and Engineering Primavera P6 Enterprise Project Portfolio Management . Affected versions include 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16, and 25.12.0-25.12.8. A low-privileged attacker...