995634 matches found
CVE-2026-86265 itsourcecode Sales and Inventory System us_transac.php sql injection
A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/ustransac.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit...
CVE-2026-86265
itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/us_transac.php , triggered by manipulation of the Username argument. The attack can be launched remotely and requires low privileges (authentication), with no user interaction needed. Per the CVS...
Erlang-OTP-PoC_CVE-2025-32433
Erlang/OTP SSH Pre-Authentication Channel Confusion πΊ Proof of Concept Video Description: A demonstration of the Erlang/OTP SSH Pre-Authentication Channel Confusion vulnerability. Click here to watch the full demo on YouTube Abstract What is this PoC about? This Proof of Concept demonstrates...
Solar-exploiting-log-4j
π₯ Solar Exploiting Log4j - TryHackMe Walkthrough π Room: Solar Exploiting Log4j Platform: TryHackMe Difficulty: Medium Topic: Log4Shell Log4j Vulnerability π§ Objective Exploit the Log4j vulnerability CVE-2021-44228 to gain remote code execution and capture flags. π οΈ Tools Used Nmap Burp Suite cURL...
CVE-2026-53921
π¨ CVE-2026-53921 - odhcpd Critical Stack-Based Buffer Overflow in OpenWrt odhcpd A remote unauthenticated stack-based buffer overflow allowing potentialRemote Code Execution RCE with root privileges. π Overview β‘ Description CVE-2026-53921 is a critical stack-based buffer overflow affecting the...
CVE-2026-51565
CVE-2026-51565 Security Advisory for CVE-2026-51565 Description Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request Mitigation At the time of...
PHP-CGI-RCE-Scanner
PHP CGI RCE CVE-2024-4577 Scanner Just a tool for educational purposes. No legal responsibility. Scanning CVE-2024-4577 vulnerability with a url list. Not only sending exploit, but also checking PHP version and whether php-cgi exists. Make it more informative to know why or why not exploit succes...
CVE-2026-86264
sfturing ssm_pro (a Java-based hospital ordering system) contains a cross-site scripting (XSS) vulnerability in the Order Endpoint (OrderController.java). An attacker can manipulate the hospitalName, officesName, or doctorName arguments to inject script, which executes in a victim's browser upon ...
CVE-2026-86264 sfturing ssm_pro Order Endpoint OrderController.java cross site scripting
A flaw has been found in sfturing ssmpro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName...
ExploitDotNetDCOM
ExploitDotNetDCOM c James Forshaw 2014 A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET. For information purposes only. All code is licensed under GPLv3...
tap
The TrustedSec Attack Platform TAP TAP - Remote penetration testing platform builder. Written by: David Kennedy @HackingDave Company: TrustedSec https://www.trustedsec.com Project page: https://github.com/trustedsec/tap A TrustedSec Project - Copyright 2020 Supported operating systems: Linux Ubun...
CVE-2026-86263
sfturing hosp_order is a Java-based hospital order management application. The vulnerability affects the Order Cancellation component, specifically the orderRecordsService.cancelOrder function in ssm_pro/src/main/java/cn/sfturing/web/OrderController.java. Manipulation of the ID argument enables a...
CVE-2026-86262
CVE-2026-86262 affects sfturing hosp_order (up to commit 627f426), an order-handling component in the file OrderController.java . The updateOrderdiseaseInfo function permits authorization bypass by manipulating the userID/id argument, allowing a remote, unauthenticated attacker to interfere with ...
CVE-2026-24061
π¨ CVE-2026-24061 β βTelneTDβ Critical Remote Authentication Bypass in GNU Inetutils telnetd The ghost of 2015 just came back to own everything still running telnet. Zero authentication. One environment variable. Instant root shell. β οΈ Overview CVE-2026-24061 is a critical remote privilege...
CVE-2026-13001
CVE-2026-13001 β Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch β PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...
CVE-2026-86244
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...
CVE-2026-86241
A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...
CVE-2026-86245
A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...
CVE-2026-86240
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source results in server-side request forgery. The attack can be executed remotely...
CVE-2026-86239
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is...