CVE-2026-128335

The Contao CMS (versions 4.6.0 before 5.3.54 , 5.4.0-RC1 before 5.7.17 , and 6.0.0-RC1 before 6.0.6 ) is vulnerable to a Session Invalidation Failure when modifying two-factor authentication (2FA) settings. The root cause is that the Contao\User::isEqualTo() function and serialized session data d...

EUVD-2026-125042

Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo and serialized session data omit two-factor state, attackers already holding a session...

CVE-2019-5420-PoC

CVE-2019-5420-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Nice argparse stuff, not a bad PoC Usage usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY VALUE...

Microsoft-Edge-Information-Disclosure

Microsoft-Edge-Information-Disclosure CVE-2024-30056 Microsoft Edge Chromium-based Information Disclosure Vulnerability This is a vulnerability in Microsoft Edge Chromium-based. The attacker was able to trick the user into revealing sensitive information without his knowledge. Poc: PoC...

CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

CVE-2025-32432

🔐 CVE-2025-32432 — Craft CMS Pre-Auth RCE Pre-Authentication Remote Code Execution in Craft CMS Discovered & Developed by Mohammed Idrees Banyamer 📌 Overview CVE-2025-32432 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting multiple versions of Craft CMS. By chaini...

CVE-2026-115340 Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server

Progress Software WSFTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations...

PT-2026-140444

Name of the Vulnerable Software and Affected Versions WS FTP Server versions prior to 2025.0.5 Description On Windows, the software may write sensitive user credentials and session data to a temporary file during file transfer operations. Recommendations Update to version 2025.0.5...

CVE-2026-62346

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in...

CVE-2026-62346

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in...

CVE-2026-62346

The Wanderer self-hosted trail database (prior to version 0.19.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . An authenticated local user can submit malicious waypoint.name and waypoint.icon values which are interpolated into an innerHTML template in web/src/lib/vendor/maplibre-elevatio...

CVE-2026-103935

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text, which uses...

CVE-2026-103935 OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text, which uses...

CVE-2026-103935

The electronic health records application OpenEMR contains a stored XSS vulnerability in versions prior to 8.3.0 . The issue exists in interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php, where the application renders transfer_to, code, and codetext va...

CVE-2026-103935 OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text, which uses...

CLEANSTART-2024-LV90734 Address bar search suggestions in private browsing mode were re-using session data from normal mode

Security vulnerability affects the firefox package. Address bar search suggestions in private browsing mode were re-using session data from normal mode...

CVE-2026-119563

A flaw was found in phpMyAdmin. This stored cross-site scripting XSS vulnerability allows an authenticated database user with table creation privileges to execute arbitrary script in another user's browser session. By creating a database table with a name containing malicious markup, the unescape...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Context.JSONP and Context.JSONPBlob methods in context.go. An attacker can make a victim’s browser execute arbitrary JavaScript in the site’s origin by sending a request with a crafted callback value tha...

Fake AI Attacks Target US Firms as Researchers Warn of Corporate Credential Theft

ANY.RUN analyzed 1,258 sandbox submissions showing how fake ChatGPT and Claude downloads and setup guides steal corporate credentials and browser session data...

GHSA-763V-5PJM-FX36 Strands Agents: Default FileSessionManager storage is world-readable on shared systems

There is a local confidentiality issue in the default FileSessionManager storage behavior. By default it writes session data under /tmp/strands/sessions and relies on the process umask for directory and file permissions. On systems using the common umask 022, the session directories are 0755 and...