vimana-framework

Overview Vimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to assess, fuzz, and analyze Python projects through automated and manual techniques. Core Capabilities: Vulnerability detection and...

printix-CVE-2022-30006

CVE-2022-30006 Simple Release | Print Friendly PrintixService.exe 中存在一个“向未授权角色泄露敏感信息”或/和“暴露危险的方法或功能”漏洞，影响 Kofax Printix 的“Printix Secure Cloud Print Management”版本 1.3.1156.0 及更低版本。本地或远程攻击者能够通过调用多个 UITask 事件读取网络上的高度敏感信息。这使攻击者能够读取网络上的所有驱动程序版本（打印机和客户端）、读取敏感配置信息，并列出网络中所有打印机，即使登录用户没有查看这些信息的适当权限。...

CVE-2024-10355

源码 Petrol pump management software free download | SourceCodester 描述 sourcecodester Petrol pump management software v1.0 存在 SQL 注入漏洞。该漏洞被评为高风险，影响 admin\invoice.php 文件的某些未知功能。攻击者可以利用参数 id 构造恶意 SQL 语句来获取敏感信息，从而造成危害。 漏洞分析 admin\invoice.php 此处，用户输入 $POST'id' 被直接拼接到 SQL 查询语句中，显然容易受到 SQL 注入攻击。 漏洞复现...

Redash Setup Configuration - Default Secrets Disclosure

Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...

PHPIPAM <v1.5.1 - Missing Authorization

In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...

MicroStrategy Library <11.1.3 - Cross-Site Scripting

MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Download Monitor <= 4.7.60 - Sensitive Information Exposure

The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and...

CentralSquare CryWolf - Path Traversal

A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf False Alarm Management through 2024-08-09 allows unauthenticated attackers to read files outside of the working web directory via the rpt parameter, leading to the disclosure of sensitive information. id: CVE-2024-45241 info:...

TestRail-files.md5-IAC-scanner

TestRail-files.md5-IAC-scanner Gurock TestRail 7.2.0.3014 之前版本中的访问控制不当（Improper Access Control）导致敏感信息泄露。威胁行为者可以访问 Gurock TestRail 应用程序客户端的 /files.md5 文件，从而泄露应用程序文件的完整列表及对应的文件路径。这些对应的文件路径可以被测试，在某些情况下，会导致硬编码凭据、API 密钥或其他敏感数据的泄露。 来源：https://vulners.com/cve/CVE-2021-40875 摘要 编写此脚本是为了能够通过查看返回的文本，快速识别在受...

CVE-2026-91744

Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

EUVD-2026-79941

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2025-24071

CVE-2025-24071 CNA: Microsoft Corporation Publicado: 2025-03-11 Actualizado: 2025-03-13 Título: Vulnerabilidad de suplantación en el Explorador de archivos de Microsoft Windows Descripción La exposición de información confidencial a un actor no autorizado en el Explorador de archivos de Windows...

CVE-2026-16432

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

CVE-2026-18065 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i...

EUVD-2026-74892

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to informati...

CVE-2026-21109

Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...

CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-87590

Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via crafted network traffic. Chromium security severity: Medium...

DEBIAN-CVE-2026-87523

Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-87518

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...