41032 matches found
GHSA-2QVG-QR73-MQXP conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target
Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...
conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target
Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...
CVE-2026-74845
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-74845
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
EUVD-2026-60077
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-74845
CVE-2026-74845 concerns the Official Document Management System by 2100 Technology, with an Arbitrary File Upload vulnerability that enables authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. From the connected references, ...
CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
[SECURITY] Fedora 43 Update: rust-pretty-git-prompt-0.2.2-11.fc43
Your current git repository information inside a beautiful shell prompt...
PT-2026-73433
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...
PT-2026-76810
Name of the Vulnerable Software and Affected Versions powerlevel10k affected versions not specified Description The software fails to neutralize control characters within the version field of a package.json file when rendering the package prompt segment. This allows an attacker to inject raw esca...
PT-2026-76723
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description In the glances/actions.py file, the GlancesActions.run function fails to respect the --disable-config-exec flag when processing on-alert action commands. This occurs because the function invokes secu...
Budibase 3.31.4 Authentication Bypass / Remote Code Execution
Budibase versions through 3.31.4 contain an authentication and authorization bypass vulnerability that allows an unauthenticated remote attacker to access protected API endpoints by placing a webhook route pattern in the request query string. This proof of concept first verifies the bypass agains...
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
Exploit Title: WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload Google Dork: N/A Date: 2026-07-15 Exploit Author: Mohammad Hossein Sadeghian Vendor Homepage: https://wordpress.org/plugins/payment-gateway-pix-for-woocommerce/ Software Link:...
PT-2026-76794
Name of the Vulnerable Software and Affected Versions Tenda W20E version V16.01.0.62782 Description The '/goform/telnet' endpoint allows unauthenticated remote attackers to activate the Telnet daemon, which enables them to obtain root shell access to the device. Recommendations At the moment, the...
EUVD-2026-60538
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
CVE-2026-67966: Missing Authentication for Critical Function
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
CVE-2026-67966
The Tenda W20E V5.0 wireless router (running firmware US_W20EV5.0qu_V16.01.0.6(2782)_CN&EN_TDE01.bin) is vulnerable to an unauthenticated remote attack via the /goform/telnet endpoint. This vulnerability allows an attacker to activate the Telnet daemon and install iptables rules that expose port ...