316315 matches found
ThisSeemsWrong
Fix for this issue appeared as CVE-2024-49746: bulletin, patch "Questo sembra sbagliato" Il titolo sopra è il commento dal metodo Parcel::continueWrite, che in realtà è responsabile del ridimensionamento degli oggetti Parcel, sia quando esplicitamente richiesto dall'utente ad esempio tramite...
AgentMemshell
AgentMemshell Ein Fork von Agent Memory Shell basierend auf MemShellParty, der mit gängigen Betriebssystemen kompatibel ist. Geeignet für Szenarien ohne Rückmeldung bei der Befehlsausführung unter allen JDK-Versionen, um Memory-Shells in alle Java-Prozesse zu injizieren. Derzeit ist nur die...
OpenSovix
CVE-2025-46285 – Tiefgehende Sicherheitslückenanalyse und Proof-of-Concept Wichtiger Haftungsausschluss: Die folgenden Inhalte dienen ausschließlich der Sicherheitsbildung, defensiven Forschung und der Analyse von Sicherheitslücken. Testen oder nutzen Sie diese Sicherheitslücke nicht in nicht...
universal-flutter-ssl-pinning
universal-flutter-ssl-pinning Dekompliliert libflutter.so mit PyGhidra, um die SSL-Zertifikatsprüfungsfunktion zu lokalisieren, und erstellt dann einsatzbereite Umgehungsskripte für Frida und Renef. Funktionsweise 1. PyGhidra lädt libflutter.so headless und durchsucht alle definierten Strings nac...
PT-2026-82626
Affected versions of Flowintel expose the /my assignment/user API endpoint to any authenticated API user. The endpoint accepts a user id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-37064
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...
CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
EUVD-2026-67255
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...
EUVD-2026-67254
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...
PT-2026-82785
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get arrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND IN SET SQL clause without proper sanitization. This allo...
TencentOS Server 3: mingw-glib2 (TSSA-2026:0917)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0917 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
CVE-2026-75417
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...
CVE-2026-26899
luci-app-https-dns-proxy on OpenWrt contains a command injection vulnerability in the setInitAction function (/usr/libexec/rpcd/luci.https-dns-proxy). Authenticated users can execute arbitrary shell commands by injecting shell metacharacters through the name parameter. The flaw was addressed in P...
CVE-2026-35869
CVE-2026-35869 is a command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library on the LB-link Router AC450M V4.0.0 . The root cause is insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution contex...
CVE-2026-35868
A Command Injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-link Router AC2100_AZ3 V1.0.4 . The root cause is insufficient validation and sanitization of user-supplied input before it reaches a system-level command execution context. An attacker...
CVE-2026-74674
In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...
EUVD-2026-67101
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
PT-2026-82538
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to file get contents without...
PT-2026-82662
BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...
PT-2026-82660
An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...