Concrete CMS 安全漏洞

Concrete CMS is an open-source content management system developed by Concrete CMS. Versions prior to Concrete CMS 9.5.0 contained security vulnerabilities. These vulnerabilities stemmed from the User Profile Editing controller, which passed the entire original POST array to UserInfo::update...

PT-2026-42502

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm add str POST parameter directly into an HTML form hidden input value attribute...

PT-2026-42509

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description An issue exists in the 'tables.php' endpoint where multiple POST parameters, specifically tablename, indexname, and sortby, are concatenated into table or column identifiers within...

tickets 跨站脚本漏洞

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of proper cleaning of multiple POST parameters in the dbloader.php file,...

Exploit for CVE-2020-25078

ABYSS C2 — HiSilicon DVR Exploit Framework ⚠️ EDUCATIONAL...

CVE-2026-48110

creationtimestamp| type| source ---|---|--- 2026-05-20 22:50:48+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-4r3c-5hpg-58qr 2026-06-10 23:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnxsv4ht3726 2026-06-10...

CVE-2026-48107

creationtimestamp| type| source ---|---|--- 2026-05-20 22:48:53+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-g9g7-5cgw-6v28 2026-06-10 23:14:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxtnhsjxw2v...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the POST /wikis/wikiName endpoint. An attacker can create or update documents in the target wiki by sending unauthenticated requests to the affected REST endpoint. Remediation Upgrade...

CVE-2026-6566

creationtimestamp| type| source ---|---|--- 2026-05-20 21:33:51+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmcu5kga3j2a...

CVE-2026-9144

creationtimestamp| type| source ---|---|--- 2026-05-20 21:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcsfpa4pg2c...

CVE-2026-24218

creationtimestamp| type| source ---|---|--- 2026-05-20 20:52:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcrw542q32e 2026-05-22 22:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmhwoqlnxh2l 2026-07-23 15:37:06+00:00| seen|...

CVE-2026-33137

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/wikiName API executes a XAR import without...

CVE-2026-9084

creationtimestamp| type| source ---|---|--- 2026-05-20 19:37:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcnpje5ms2p...

CVE-2026-20199

creationtimestamp| type| source ---|---|--- 2026-05-20 19:00:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmclofeilq2k 2026-07-23 12:16:40+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrcsxagkhl2e...

EUVD-2026-31157

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/wikiName API executes a XAR import without performing any...

CVE-2026-33137

CVE-2026-33137 — XWiki Platform : The issue affects XWiki Platform where, in versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API performs a XAR import without authentication or authorization checks, allowing an unauthenticated attacker to create or update ...

CVE-2026-33137

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/wikiName API executes a XAR import without...

CVE-2026-20171

creationtimestamp| type| source ---|---|--- 2026-05-20 18:47:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmckxnd7wn2h 2026-07-23 12:18:09+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrcszvdsr52x...

CVE-2026-44925

creationtimestamp| type| source ---|---|--- 2026-05-20 18:42:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcknh7ixm2e...

MAL-2026-4360 Malicious code in @aledan007/tester (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab03e3eef2f59f358cdaacedf2d9facb12077110c5402ad36aad6e3581e66439 The bundled server file dist/server/index.js contains a hardcoded reference to the attacker-controlled domain https://evil.attacker-example.com...