CVE-2009-0229-PoC

CVE-2009-0229-PoC PoC for CVE-2009-0229 "Print Spooler Read File Vulnerability" LPE AFR related to CVE-2020-1048 Details Author: Andrei Costin [email protected] https://twitter.com/costinandrei/ PoC date: 2010-xx-xx Release date: 2020-05-14 reminded/inspired by CVE-2020-1048 - yes, I am too...

CVE-2023-36143

CVE-2023-36143 PoC of CVE-2023-36143 - Maxprint Maxlink 1200G v3.4.11E Command Injection Steps to Reproduce: 1. Log in the equipment via your web browser 2. Go to the diagnostic tool 3. Insert any ip, e.g 127.0.0.1, the ; character and a command. 4. Example: 127.0.0.1;cat /etc/passwd...

CVE-2026-111232

Netgate pfSense CE versions 2.3.0 through 2.9.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the separator color field and is triggered because the display_separator() function renders the separator[] color value unencoded into class attributes. This all...

UBUNTU-CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

Linux Distros Unpatched Vulnerability : CVE-2026-107181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via...

Security Bulletin:morgan HTTP Request Logger Middleware: Unicode Line Separator Log Forge Vulnerability

Summary morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remo...

DEBIAN-CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

EUVD-2026-94329

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

PT-2026-107506

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.2.9 Description An IPC record-separator injection flaw exists in Core::Sandbox due to the failure to escape semicolons used as command separators when passing tg:// links to a running instance over a local...

CVE-2026-107181: Improper Neutralization of Record Delimiters

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 contain a heap-based buffer overflow vulnerability in its login process. In environments where domainuserseparator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name,...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Expat, LibXMLTok

In xmlparse.c within Expat also known as libexpat, prior to version 2.4.5, attackers could insert namespace-separator characters into namespace URIs...

CVE-2026-100238 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100238

The Wikimedia Foundation Mediawiki - Flow Extension is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the flow colon-separator and flow-guidedtour-optin-welcome-description messages allow for the injection of malic...