Exploit for Cross-site Scripting in Roundcube Webmail

CVE-2023-43770 POC A Proof-Of-Concept for the recently found...

Researchers Uncover New GPU Side-Channel Vulnerability Leaking Sensitive Data

A novel side-channel attack called GPU.zip renders virtually all modern graphics processing units GPU vulnerable to information leakage. "This channel exploits an optimization that is data dependent, software transparent, and present in nearly all modern GPUs: graphical data compression," a group...

CVE-2023-42820

creationtimestamp| type| source ---|---|--- 2023-09-27 08:10:17+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5228 2023-09-29 09:17:53+00:00| published-proof-of-concept| https://t.me/cKure/11645 2023-09-29 16:54:00+00:00| published-proof-of-concept| https://t.me/jokerplstaeen/2120...

Functions in the VotiumStrategy contract are susceptible to sandwich attacks

Lines of code Vulnerability details Bug Description In VotiumStrategyCore.sol, the buyCvx and sellCvx functions call exchangeunderlying of Curve's ETH / CVX pool to buy and sell CVX respectively: VotiumStrategyCore.solL233-L240 ICrvEthPoolCVXETHCRVPOOLADDRESS.exchangeunderlying value: ethAmountIn...

Incorrect AfEth.price() calculation

Lines of code Vulnerability details Impact AfEth.price may be calculated as too low. Proof of Concept AfEth.requestWithdraw does not burn the afEth but only transfers it to itself. Hence the withdrawRatio is calculated using only the free supply of afEth: AfEth.solL180-L185 // ratio of afEth bein...

sellCVX(0) reverts

Lines of code Vulnerability details Impact A withdrawal cannot be finalised if requested at a time when AfEth had only safEth, and that owed share of safEth is permanently lost. Proof of Concept It is possible that AfEth holds at most dust amounts of vAfEth if ratio = 100 %. The amounts of vAfEth...

CVE-2023-32364

creationtimestamp| type| source ---|---|--- 2023-09-26 14:54:54+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5222 2026-09-02 01:00:18+00:00| seen| Telegram/X3aV2Rz-O19d62DmeY189IyrU-cEp-mvJffxLnOe55jNbE 2026-09-03 00:00:37+00:00| published-proof-of-concept|...

CVE-2023-35793

creationtimestamp| type| source ---|---|--- 2023-09-26 11:46:42+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5220 2023-09-27 11:00:44+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9098 2023-09-27 17:04:19+00:00| published-proof-of-concept|...

CVE-2023-38346

creationtimestamp| type| source ---|---|--- 2023-09-26 11:00:46+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9089 2024-08-16 08:28:27+00:00| published-proof-of-concept| https://t.me/Rootsec2/1123 2026-07-29 12:02:26+00:00| seen| https://t.me/reverseame/3737 2026-07-30...

CVE-2023-43646

creationtimestamp| type| source ---|---|--- 2023-09-26 08:41:19+00:00| published-proof-of-concept| https://github.com/chaijs/get-func-name/security/advisories/GHSA-4q6p-r6v2-jvc5 2023-09-27 18:42:13+00:00| published-proof-of-concept| https://t.me/cibsecurity/71088...

CVE-2023-4521

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue...

CVE-2023-4521 Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue...

VotiumStrategyCore.applyRewards can be sandwhiched

Lines of code Vulnerability details Impact VotiumStrategyCore.applyRewards can be sandwhiched, so users rewards will be lost. Proof of Concept VotiumStrategyCore.applyRewards will be used in order to swap all rewards to eth and then distribute eth to the safEth or vEth. The problem here is that...

PageLayer < 1.7.7 - Unauthenticated Stored XSS

Description The plugin doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts. Unauthenticated attacker Proof of Concept 1 As a legitimate administrator, schedule a post to be published in a few minutes. 2 Close every window to that site to preve...

VotiumStrategyCore.applyRewards can be sandwhiched to make profit

Lines of code Vulnerability details Impact VotiumStrategyCore.applyRewards can be sandwhiched to make profit. Proof of Concept VotiumStrategyCore.applyRewards function will swap all rewards of contract into eth and then stake them into safEth or vEth contract. As result price of afEth token will...

CVE-2023-4281

creationtimestamp| type| source ---|---|--- 2023-09-24 12:27:29+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5198 2023-09-24 13:31:46+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5199...

Store XSS at Label sets list in (Version 6.2.7)

Description First of all, I apologize for reporting back. I noticed, the latest current version is 6.2.7. XSS vulnerabilities still exist Proof of Concept Detail: 1 .Login and access Label sets list 2 .Create new label set 3 . Insert payload in to Title haido" onclick="alert1 4 .Click save ==...

PlayStation: Remote vulnerabilities in spp

A vulnerability was discovered in the spp PPPoE implementation on the PS4/PS5. The vulnerability could allow a malicious PPPoE server to cause a heap buffer overwrite and overread, potentially leading to denial-of-service or remote code execution in kernel context. The vulnerability was caused by...

CVE-2019-13171

creationtimestamp| type| source ---|---|--- 2023-09-22 09:06:56+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/357...

Leaky faucet

Lines of code Vulnerability details Impact Leaking is bad. Proof of Concept Turn off faucet, it leaks! Tools Used Hands Recommended Mitigation Steps Teflon tape. Assessed type Other --- The text was updated successfully, but these errors were encountered: All reactions...