CVE-2025-30208-Vite

CVE-2025-30208 | Script de Vite Esta herramienta se utiliza para detectar si el sistema objetivo presenta la vulnerabilidad CVE-2025-30208. Esta vulnerabilidad permite a un atacante leer archivos sensibles del servidor como /etc/passwd o C:\windows\win.ini a través de rutas específicas. La...

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

EUVD-2026-79941

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-92237

CVE-2026-92237 affects Devolutions PowerShell Universal 2026.2.5 and earlier . The slow query logging feature writes SQL parameter values to the system log on instances backed by Microsoft SQL Server , exposing sensitive data. An authenticated user with log read permission can obtain application ...

EUVD-2026-79241

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-76820

OpenCTI, an open-source cyber threat intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in the synchronizerFetch GraphQL query prior to version 7.260701.0 . The backend's fetchRemoteStreams function validated only the HTTP/HTTPS scheme without applying the ingestion deny l...

top-dns

Medición de Top DNS Resumen Este script utiliza un mecanismo de medición probabilística integrado en Bro para medir las principales solicitudes DNS por tipo de consulta, es decir, CNAME, A, AAAA, etc. realizadas durante un período de tiempo definible. Esto se registra en un nuevo log llamado...

CVE-2026-82191

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...

CVE-2026-82191 Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...

CVE-2026-61667

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-55375

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375

canto-saas-api (PHP library for the Canto SaaS API) prior to 3.0.0 sends OAuth credentials (app_id, app_secret, refresh_token, code) in the URL query string of token POST requests rather than the request body. Because request URLs are commonly recorded in access logs, proxy logs, and APM traces, ...

EUVD-2026-78902

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-27886

CVE-2026-27886 PoC de Strapi Solo para pruebas de seguridad autorizadas. Strapi filtra datos sensibles mediante filtrado relacional debido a la falta de saneamiento de consultas. Incluye: CVE-2026-27886.py - PoC en Python CVE-2026-27886.yaml - plantilla de Nuclei para detección Qué comprueba El...

EUVD-2026-78654

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter to access restricted data like comments, reactions, and time entries without...

CVE-2026-88617

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

CVE-2025-49132

CVE-2025-49132 Prueba de Concepto PoC Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-49132, una vulnerabilidad crítica de ejecución remota de código RCE sin autenticación en versiones de Pterodactyl Panel anteriores a la 1.11.11. Detalles de la Vulnerabilidad ID de CVE :...