CVE-2022-44268-MagiLeak

ImageMagick Arbitrary Read Files - CVE-2022-44268 This repository contains a proof-of-concept PoC code for exploiting the arbitrary file read vulnerability CVE-2022-44268 in ImageMagick. The PoC demonstrates how an attacker can leverage the vulnerability to read arbitrary files on the system...

Twitter-Info

Twitter Info A simple python script to grab Twitter account info like: Name Following Followers Likes Account date Profile picture just by username or profile link. Usage python3 twitterinfo.py or Example Input python twitterinfo.py ngll Output Name: Nigella Tweets: 30 Following: 8 Followers: 4...

CVE-2026-126061

Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindModelObject resolve...

CVE-2026-126061

Winter CMS (versions 1.2.13 until 1.2.14) is vulnerable to an authorization bypass in the Backend\Controllers\MyAccount controller. The controller inherits create, update, and preview actions from FormController while declaring an empty $requiredPermissions array. Because formFindModelObject() us...

CVE-2026-126061 Winter CMS: My Account preview exposes another backend user's profile by record ID

Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindModelObject resolve...

CVE-2026-126061

Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindModelObject resolve...

PT-2026-137217

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description An excessive data exposure issue allows authenticated users to retrieve personally identifiable information PII and health-related profile data. By querying the 'GET...

CVE-2026-62991

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

EUVD-2026-114512

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991

The Shopper Headless e-commerce Admin Panel is vulnerable to an IDOR (Insecure Direct Object Reference) flaw in versions prior to 2.10.1 . The customer detail route (/cpanel/customers/{user}/show) in packages/admin/src/Livewire/Pages/Customers/Show.php fails to apply the required customers role s...

PT-2026-134221

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read customers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-107762

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-103213

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

PT-2026-116197

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.3.3 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers can expose sensitive profi...

CVE-2026-107762: Authorization Bypass Through User-Controlled Key

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Protection was added to the device queue against concurrent access. In the dasdprofilestart function, the number of requests on the device queue is counted. However, access to the device queue is not protected against...