1342 matches found
CVE-2026-54350-Budibase-NoSQL-Injection
CVE-2026-54350 — Injection d'opérateur NoSQL non authentifiée dans Budibase Injection d'opérateur JSON/NoSQL non authentifiée dans Budibase. Tout visiteur anonyme d'une application Budibase publiée qui expose une requête PUBLIQUE soutenue par une source de données documentaire MongoDB, CouchDB,...
CVE-2026-100753
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...
CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...
EUVD-2026-88435
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...
CVE-2026-100753
The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...
GO-2026-6518 Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses
Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses...
CVE-2021-40438
Эксплойт для CVE-2021-40438 PoC с настройкой Docker Перейдите в каталог, содержащий конфигурацию Apache и Dockerfile приведены в репозитории. Сборка образа: docker build -t cve-2021-40438:1.0 . Запуск Docker-образа: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Примечание: вместо имени образа...
CVE-2026-100753: Improper Neutralization of Input During Web Page Generation
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment...
cve-2023-5044
CVE-2023-5044 Preuve de concept d'exploit Ingress Nginx Ceci est un programme Go rapide pour exploiter la CVE récente dans le contrôleur Ingress Nginx. Les détails sur la façon de procéder sont déjà disponibles via le blog de Rory McCune à l'adresse...
CVE-2026-44262
PoC de RCE dedoc/scramble CVE-2026-44262 📜 Description CVE-2026-44262 est une vulnérabilité d'exécution de code à distance non authentifiée dans dedoc/scramble, un générateur de documentation d'API Laravel. NodeRulesEvaluator::doEvaluateExpression appelle extract$variables avant eval"return...
CVE-2026-55993
camel-atmosphere-websocket - Reproducteur d'injection d'en-tête CVE-2026-55993 Ce projet démontre une injection d'en-tête de message dans le composant camel-atmosphere-websocket d'Apache Camel, référencé sous CVE-2026-55993. Le consommateur WebSocket copie les paramètres de requête de la connexio...
CVE-2018-6643
CVE-2018-6643 CVE-2018-6643 Infoblox NetMRI 7.1.1 hxxp::/xxx.abc/api/docs/index.php?query=555"...
CVE-2026-100391
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...
EUVD-2026-87328
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...
CVE-2026-100391
MediaFlow Proxy versions through 2.4.9 are vulnerable to a server-side request forgery (SSRF) in the /proxy routes. The root cause is missing and incomplete destination validation in the d query parameter. This allows remote attackers to supply arbitrary internal URLs, including loopback addresse...
CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...
CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...
CVE-2026-100391: Server-Side Request Forgery (SSRF)
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...
PT-2026-97922
Name of the Vulnerable Software and Affected Versions Termix versions 2.5.0 through 2.5.0 Description The '/homepage/proxy' endpoint accepts a url query parameter from an authenticated user and passes it to http.get or https.get without destination restrictions. In the file...