115 matches found
Taipan
Taipan is now a sponsored project. The Community sponsor will receive access to the laset version of Taipan Community Edition. The free version is release after three months from the release date. To know more visit: https://github.com/enkomio-sponsor/info or https://taipansec.com. Latest Communi...
CVE-2020-10204
CVE-2020-10204 CVE-2020-10204 Remote Command Execution Script More script files at: https://github.com/zhzyker/exphub Readme +---------------------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + +...
CVE-2026-86609
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...
EUVD-2026-87889
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...
PT-2026-99494
Name of the Vulnerable Software and Affected Versions Download Manager WordPress plugin Pro edition versions prior to 7.5.6 Description The Pro edition of the plugin fails to sanitize and escape data submitted via the email-locked download subscription form before displaying it on an administrati...
GHSA-CXVF-GVFQ-36W2 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Summary Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom projec...
EUVD-2024-55573
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache, leading to code execution...
CVE-2024-53326
LINQPad Pro edition versions prior to 5.52.01 are vulnerable to Unsafe Deserialization within the LINQPad.AutoRefManager::PopulateFromCache() function. This flaw allows an attacker to achieve remote code execution by overwriting cache files containing serialized .NET objects with malicious payloa...
OpenKM 6.3.12 - Multiple
Exploit Title: OpenKM Multiple Critical Zero-Day Date: 17 Jan 2026 Exploit Author: Terra System Labs Pvt. Ltd. Vendor Homepage: https://www.openkm.com/ Software Link: https://hub.docker.com/r/openkm/openkm-ce Version: OpenKM Community Edition 6.3.12 and OpenKM Pro Edition 7.1.47 and previous...
GHSA-JQ2F-59PJ-P3M3 Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Summary The actionSavePermissions endpoint allows a user with only viewUsers permission to remove arbitrary users from all user groups. While saveUserGroups enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty groups...
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Summary The actionSavePermissions endpoint allows a user with only viewUsers permission to remove arbitrary users from all user groups. While saveUserGroups enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty groups...
Missing Authorization
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization via the actionSavePermissions process. An attacker can remove all group memberships from arbitrary users by submitting an empty groups parameter, resulting in immediate...
PT-2026-35119
Summary The actionSavePermissions endpoint allows a user with only viewUsers permission to remove arbitrary users from all user groups. While saveUserGroups enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty groups...
EUVD-2026-20408
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing Pro: from n/a...
CVE-2025-13668
A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege...
CVE-2025-13668
Quartus Prime Pro Edition Design Software is cited as potentially allowing privilege escalation. The connected sources consistently reference Quartus Prime Pro Edition Design Software, but none of the provided documents specify affected versions, exact root cause, or a remediation. Public_DETAIL ...
CVE-2025-13668 Quartus Prime Pro Edition Advisory
A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege...
CVE-2025-13668 Quartus Prime Pro Edition Advisory
A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege...
