CVE-2026-77016

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-77017

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-77016

The Workeera WordPress plugin (Remote Tech Job Board) prior to version 1.0.6 is vulnerable to arbitrary file deletion via mass assignment on the candidate profile. The plugin does not restrict which values a user can write to their own candidate profile, nor does it validate the stored file path ...

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

Malleable-C2-Randomizer

Malleable-C2-Randomizer Dieses Skript randomisiert Malleable-C2-Profile für Cobalt Strike mithilfe einer Metasprache, wodurch hoffentlich die Wahrscheinlichkeit verringert wird, signaturbasierte Erkennungsmaßnahmen auszulösen. Kurz gesagt, das Skript parst die bereitgestellte Vorlage, ersetzt die...

roller-csrf

Apache Roller v6.1.2 - Falsification de requête intersite CSRF dans la mise à jour du profil Détails de la vulnérabilité Version : v6.1.2 Date : 2025-11-09 Auteur de l'exploit : Van Lam Nguyen Facebook : https://www.facebook.com/vanlam1412 Page d'accueil du fournisseur : https://roller.apache.org...

mbadanoiu

Bem-vindo ao Retiro de Fim de Semana de Matei "Mal" Badanoiu Este GitHub é usado para publicar meus CVEs e Pesquisas de Segurança durante meu tempo livre/fins de semana. Todos os materiais presentes neste perfil do GitHub são destinados à pesquisa de segurança e ao hacking ético. Não endosso...

EUVD-2026-66768

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

Linux Distros Unpatched Vulnerability : CVE-2026-81893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leav...

CVE-2023-5612

Divulgazione dell'email pubblica nel feed RSS dei tag https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ root@kitploit: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was...

profilehound

root@kitploit: / \ / / / / / / / / / // / / / // / / / // / / / / / / / / / / / // / / / / / / // / // / / / / // / // // // ///// ///,// //,/ ProfileHound ProfileHound è uno strumento post-elevazione progettato per aiutare a individuare e raggiungere obiettivi di red-teaming, localizzando...

CVE-2026-43621

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

InfraGuard

Red-Team-Infrastruktur-Tracker und C2-Redirector -- eine moderne Alternative zu RedWarden. InfraGuard sitzt zwischen dem Internet und deinem C2-Teamserver und validiert jede eingehende Anfrage gegen dein malleable C2-Profil. Alles, was nicht konform ist, wird blockiert. Scanner, Bots und...

CVE-2025-69727

CVE-2025-69727 Fornecedor do Produto INDEX-EDUCATION Código Base do Produto Afetado PRONOTE - 202X.X.X 2025.2.8 Descrição Existe uma vulnerabilidade de Controle de Acesso Incorreto no INDEX-EDUCATION PRONOTE anterior à versão 2025.2.8. Os componentes afetados composeUrlImgPhotoIndividu permitem a...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager में मनमानी फ़ाइल लेखन पथ ट्रैवर्सल -orange 📋 विवरण CVE-2026-20262 Cisco Catalyst SD-WAN Manager पहले SD-WAN vManage के वेब इंटरफ़ेस में पथ ट्रैवर्सल CWE-22 भेद्यता है। यह एक प्रमाणित हमलावर को लेखन अनुमतियों के साथ AnyConnect प्रोफ़ाइल अपलोड endpoint...

CVE-2025-14221

Beschreibung 1. CVE-2025-14221 2. Entdecker: Fatma Trabelsi 3. Anbieter des Produkts: SourceCodester 4. Betroffenes Produkt: Online Banking System 1.0 POC In der Funktion zur Aktualisierung des Benutzerprofils der Anwendung besteht eine Schwachstelle bezüglich gespeichertem Cross-Site-Scripting...

CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2026-43621

Simple Machines Forum (SMF) through 2.1.7 contains an authorization state-confusion vulnerability in the profile loader (Profile::load()). By supplying multiple values for the user parameter, an authenticated low-privileged user can exploit a mismatch between Profile::$member and User::$me-&gt;is...

CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...