435 matches found
CVE-2023-23752
CVE-2023-23752 CVE-2023-23752 nuclei template Joomla CVE-2023-23752 - a request parameter breaks through the Rest API Affected version Joomla roughly has three routing entries, which are 1. index.php in the root directory users access articles 2. administrator/index.php in the root directory...
poc-cve-2018-1273
CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...
extended-ssrf-search
Extended ssrf search This tool search for SSRF using predefined settings in different parts of a request path, host, headers, post and get parameters. First step Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend ...
Jenkins-CVE-2024-23897-Lab
Jenkins CVE-2024-23897 Lab Arbitrary file read vulnerability in Jenkins 2.441 and earlier. Launch docker-compose up -d Automated Attack docker exec -it attacker-host ./auto-exploit.sh Manual Attack docker exec -it attacker-host bash cd /tmp curl -o jenkins-cli.jar...
CVE-2025-52289
CVE-2025-52289: Broken Access Control in MagnusBilling v7.8.5.3 Description A Broken Access Control vulnerability exists in MagnusBilling versions prior to v7.8.5.3. Newly registered users can escalate their account status from pending to active without administrator approval by modifying a reque...
CVE-2026-113667
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...
CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...
CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...
CVE-2026-113667
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...
CVE-2026-113667
ApostropheCMS, an open-source Node.js content management system, contains a vulnerability in three CAPTCHA integrations: Form , login-recaptcha , and login-hcaptcha . The flaw exists because these components interpolate an unencoded user-supplied response token into the provider verification requ...
CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted token...
PT-2026-118468
Configurable Reports block for Moodle moodle-block configurablereports before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can...
PT-2026-118582
Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5 ApostropheCMS login-recaptcha versions prior to 1.2.1 ApostropheCMS login-hcaptcha versions prior to 1.3.0 Description CAPTCHA integrations in the Form, login-recaptcha, and login-hcaptcha modules...
Apostrophe Technologies ApostropheCMS has a vulnerability related to improper output processing.
Apostrophe Technologies' ApostropheCMS has a vulnerability in its output processing. This vulnerability stems from the fact that these CAPTCHA integrations insert unencoded response tokens provided by users into provider validation requests. This can lead to request parameter injection, disruptio...
Linux Distros Unpatched Vulnerability : CVE-2026-76182
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request pa...
CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...
CVE-2026-107375
Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...
CVE-2026-107375: Improper Neutralization of Special Elements used in an SQL Command
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...
CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...