heisenberg-ssc-gha

Heisenberg Dependency Health Check GitHub Action A lightweight PR guardrail for dependency updates. It scans new or changed dependencies only from your lock/manifest, pulls health and risk signals deps.dev + heuristics, flags fresh publishes, comments a report on the PR, optionally labels it for...

CVE-2018-11686

CVE-2018-11686 CVE-2018-11686 - FlexPaper PHP 发布服务 RCE = 2.3.6 由 Red Timmy Security 发现 技术分析： https://www.exploit-db.com/docs/english/46521-flexpaper-=-2.3.6-remote-code-execution-whitepaper.pdf 安全通告： 未知 概念验证： 1. 删除配置文件 FlexPaper（PHP）的 changeconfig.php 文件不会检查管理员是否正确认证，从而允许攻击者删除服务器上的任意文件：...

hpfeeds

hpfeeds 关于 hpfeeds 是一种轻量级的、经过认证的发布-订阅协议。它拥有简单的线上格式，因此每个人都能在几乎瞬间用自己喜爱的语言订阅这些订阅源。不同的订阅源通过频道进行区分，并支持任意的二进制负载。这意味着频道用户自行决定数据的结构。通常会在 hpfeeds 上传输 JSON。 本项目旨在提供一个基于 asyncio 构建的、现代且兼容 Python 3 的 broker，以及一个兼容 Python 3 的客户端。 安装 核心客户端没有任何依赖。您可以通过 pip 来安装它。 root@kitploit: pip install hpfeeds 您可以通过命令行运行一个...

CVE-2026-68004

CVE-2026-68004：SRS 未认证 RTMP 推流 概述 本仓库包含 CVE-2026-68004 的技术报告和概念验证（PoC），该漏洞是 OSSRS / SRS 部署中存在的未认证 RTMP 推流问题，当 vhost.security 被禁用且未配置其他推流认证时触发。 文件 文件| 用途 ---|--- CVEReportSRSUnauthPublish.md| 漏洞报告 pocsrsunauthpublish.py| 仅使用标准库的独立 Python 3 PoC 运行 PoC 仅针对你已获授权测试的系统运行。 root@kitploit: python...

SiYuan <= v3.6.1 - Bookmark Data Disclosure

SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service. id:...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

SiYuan <=3.7.2 - SQL Injection

SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content. id: CVE-2026-69085 info: name: SiYuan...

CVE-2024-50335

CVE-2024-50335：已验证的XSS漏洞在“发布密钥”字段中允许未经授权的管理员用户创建 摘要 SuiteCRM 编辑个人资料页面中的“发布密钥”字段存在反射型跨站脚本（XSS）漏洞，允许攻击者注入恶意 JavaScript 代码。该漏洞可被利用来窃取 CSRF 令牌并执行未经授权的操作，例如在没有适当认证的情况下创建新的管理员用户。 详情 该漏洞源于 SuiteCRM 应用程序对发布密钥字段的输入验证和清理不足。当攻击者注入恶意脚本时，该脚本会在已认证用户的会话上下文中执行。注入的脚本（o.js）随后利用捕获的 CSRF 令牌伪造请求，创建新的管理员用户，从而有效破坏 CRM...

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress (versions up to and including 2.4.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'pages' parameter in admin settings, caused by insufficient input sanitization and output escaping. An authenticated attacker with administrator-level ...

EUVD-2026-83480

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-8054

1. 漏洞概述 CVE-2026-8054 是一个存在于 dotCMS Core 发布审计 API（Publish Audit API）中的高危前台无需认证 SQL 注入漏洞 （Pre-auth SQL Injection）。该漏洞由官方追踪为安全事件 SI-75 ，并于 2026 年 5 月底被正式收录披露。由于攻击者无需任何账号权限即可远程触发，其潜在危害非常严重。 属性| 值 ---|--- CVE编号| CVE-2026-8054 官方追踪| SI-75 漏洞类型| SQL注入 CWE-89 影响组件| dotCMS Core - Publish Audit API CVSS评分...

WordPress WP2Social Auto Publish plugin <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'pages' Parameter vulnerability discovered by Luca Jungnickel in WordPress Plugin WP2Social Auto Publish versions = 2.4.12...

CVE-2026-92912

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the...

CVE-2026-83220

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Event Publish and Subscribe. Supported versions that are affected are 23.6-26.7. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

CVE-2026-83220

Oracle Siebel CRM contains a vulnerability in the Siebel CRM Integration product, specifically in the Event Publish and Subscribe component, affecting supported versions 23.6 through 26.7 . The flaw allows an unauthenticated attacker with access to the physical communication segment attached to t...

CVE-2026-90879

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

EUVD-2026-78269

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-90879 zyx0814 FilePress Publish search.php sql injection

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...