CVE-2019-17591

Bolt CMS 3.x contains a CSRF vulnerability (CVE-2019-17591) demonstrated by public exploits targeting Bolt CMS 3.6.10. The exploit describes an authenticated user CSRF payload that posts to /index.php/async/folder/create to perform actions on behalf of the user. Connected sources show CSRF risk i...

CVE-2022-30507

CVE-2022-30507 has public PoC/exploit activity documented in connected records. CIRCL reports a detection sighting with a published PoC (creation date 2022-07-16) and linked discussions; two GitHub exploits (CVE-2022-30507-PoC) describe remote code execution by executing JavaScript in the rendere...

CVE-2018-10006

Technical details for CVE-2018-10006 are not publicly available in the provided documents. Monitor for updates as more information may be released.

CVE-2022-24087

CVE-2022-24087 is the follow-on to CVE-2022-24086, an Improper Input Validation vulnerability in Adobe Commerce/Magento Open Source that enables pre-authenticated remote code execution. Connected sources indicate it affects Magento Open Source/Adobe Commerce 2.3.3-p1–2.3.7-p2 and 2.4.0–2.4.3-p1, ...

CVE-2020-24597

CVE-2020-24597: Joomla core contains a directory traversal in com_media that allows access to files outside the webroot. Public sources list affected versions as Joomla core up to 3.9.24 (Nessus plugin 112581) and up to 3.9.20 (OpenVAS entry). Root cause is lack of input validation for com_media ...

CVE-2019-7966

CVE-2019-7966 details are not provided in the supplied documents. No product, impact, or remediation information is available. Monitor for updates from official disclosures.

CVE-2019-7967

Technical details for CVE-2019-7967 are not provided in the connected documents. The entry remains reserved/no public details here. Monitor for updates as information may be released later.

CVE-2020-4034

CIRCL’s CIRCL:CVE-2020-4034 entry shows a published proof-of-concept (PoC) for CVE-2020-4034, with the PoC noted on 2022-01-26 via Telegram. The provided documents do not include concrete technical details (affected products/versions, root cause, impact, or remediation) beyond this PoC reference.

CVE-2016-5641

CVE-2016-5641 describes a remote code execution vulnerability in Swagger Code Generator workflows. Concrete details in connected docs show that malicious Swagger JSON/YAML can inject parameters in code-generation templates, enabling executable code on NodeJS, PHP, Ruby, and Java environments that...

CVE-2016-2534

CVE-2016-2534 is associated with a directory-traversal vulnerability in Jive Forums versions 5.5.25 and earlier (as evidenced by CNVD-2016-02415 and 1337DAY entries). The flaw allows accessing files outside the web directory and is reported as exploitable remotely in affected builds (JiveForums ≤...

CVE-2014-2239

CVE-2014-2239 is associated with Lazarus Guestbook v1.22. Connected sources detail multiple web vulnerabilities in Lazarus Guestbook: (1) a SQL injection in admin.php via the gbsession parameter in the settings panel/general, exploitable via GET with low-privileged user and no user interaction, p...

CVE-2014-5469

CVE-2014-5469: Connected material documents indicate an authenticated stored XSS in Arachni Web UI (v0.4.4/v0.4.7 mentioned) via the Web UI’s Markdown-enabled comments after initiating a scan. The exploit requires login and payloads like [XSS](javascript:alert('XSS')) can execute when a comment i...

CVE-2014-3736

CVE-2014-3736 affects Allplayer 5.9 and earlier. A memory corruption flaw is triggered by loading a malformed WAV file, per PacketStorm’s 5.9 memory corruption report. An exploit is documented (Exploit-DB reference in CIRCL sighting) indicating public exploitation. The connected data confirms the...

CVE-2014-3212

CVE-2014-3212 is evidenced by connected data: KM Player versions up to 3.8.0.123 are vulnerable to a stack-based buffer overflow caused by improper handling of AVI parsing, enabling arbitrary code execution. Exploit details and a PoC exist (PacketStorm entry; Exploit-DB reference). No remediation...

CVE-2014-2923

Convergence of connected data shows a concrete CVE-2014-2923 vulnerability in the Comtrend CT-5361T router: a Cross-Site Request Forgery (CSRF) affecting passwd changes and an associated Cross‑Site Scripting (XSS) issue. The Packet Storm entry documents CT-5361T (likely CT-536X) with software ver...

CVE-2130-5680

CVE-2013-5680 affects HylaFAX+ daemon hfaxd, versions 5.2.4–5.5.3. It exploits a heap-based buffer overflow from unchecked inbound network data (LDAP path in LDAP-enabled configurations), potentially crashing the server and possibly enabling code execution. Vendor fixed in HylaFAX+ v5.5.4 or late...

CVE-2013-2649

CVE-2013-2649 is evidenced by HTB advisory describing two XSS flaws in Hero Framework due to insufficient sanitisation of user input. The vulnerability is triggered via HTTP GET parameters: username in /users/login and error in /users/forgot_password, allowing crafted links to execute arbitrary H...

CVE-2012-4748

CVE-2012-4748 shows a placeholder initial description, but a CIRCL sighting indicates a confirmed exploit-db entry (ID 21005) with a 2012-09-02 timestamp. The provided connected data do not specify affected product/vendor, vulnerable component, root cause, impact, or remediation. Therefore, the e...

CVE-2012-4749

Technical details for CVE-2012-4749 are not publicly available in the provided documents. No affected products, impact, or remediation are specified here. Monitor for updates from authoritative sources.

CVE-2011-4025

ExpressionEngine 2.2.2 and CodeIgniter 2.0.3 are affected by CVE-2011-4025 due to flaws in the CI_Security xss_clean filter and its _remove_evil_attributes function, which bypass the internal XSS protection and enable remote XSS attacks. This can lead to session hijacking, information disclosure,...