CVE-2026-11115-Database-Connection-String-Injection-via-Env-Variable

CVE-2026-11115 – Database Connection String Injection via Env Variable Program Code Python dbconnector.py - Constructs DB connection string from environment import os, psycopg2 def connect: Reads DBURL; attacker can override via environment injection if they control an env var dburl =...

text4shell-docker

Instalar maven - maven-linux 1. Instalar Maven para crear el fat jar mvn clean install 2. Construir la imagen Docker docker build --tag=text4shell . 3. Ejecutar el contenedor Docker docker run -p 80:8080 text4shell 4. Probar la aplicación http://localhost/text4shell/attack?search= 5. El ataque se...

how-to-check-patch-secure-log4j-CVE-2021-44228

Cómo comprobar log4j CVE-2021-44228 ¿Qué es log4j ? LOG4J es un software Apache de código abierto basado en Java utilizado para servicios de registro. ¿Qué es la vulnerabilidad log4j CVE-2021-44228 ? La vulnerabilidad Log4j permite la ejecución remota de código con solo escribir una cadena...

CVE-2026-3008

CVE-2026-3008 — Inyección de cadena de formato en Notepad++ 8.9.3 mediante nativeLang.xml Vulnerabilidad Cuando una operación de búsqueda produce resultados, sub1400916C0 formatea una etiqueta de recuento de coincidencias recuperando una cadena localizada de nativeLang.xml y pasándola directament...

AlmaLinux 9.2 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1744782967)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744782967 advisory. - A buffer overflow flaw was found in base/gdevdevn.c:1973 in devnpcxwriterle in ghostscript. This issue may allow a local attacker ...

Rocky Linux 9 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc Multiple Vulnerabilities (crlsa-2024_6197)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246197 advisory. ghostscript: format string injection leads to shell command execution SAFER bypass CVE-2024-29510 ghostscript: path traversal and command execution due to...

CVE-2019-11043

PoC CVE-2019-11043 Una versión en Python del exploit CVE-2019-11043 https://github.com/neex/phuip-fpizdam Este PoC es aún un borrador, por favor usa el exploit escrito por @neex Análisis de vulnerabilidad: https://paper.seebug.org/1064/ Configuración del PoC Simplemente ejecuta docker compose par...

CVE-2019-0232

CVE-2019-0232 Apache Tomcat CGIServlet enableCmdLineArguments RCE Inyección en scripts batch de Windows mediante argumentos de la cadena de consulta Descripción Apache Tomcat con el servlet CGI habilitado y enableCmdLineArguments=true pasa los parámetros de la cadena de consulta como argumentos d...

CVE-2026-31816

CVE-2026-31816 - Bypass de autenticación a RCE en Budibase CVE-2026-31816 es una vulnerabilidad crítica de bypass de autenticación y autorización que afecta a Budibase. La vulnerabilidad se encuentra en el middleware de autorización del lado del servidor responsable de proteger los endpoints de l...

automation-controller: automation-controller-container: automation-controller: format string injection in the API 4XX error log setting discloses Django SECRET_KEY and database credentials to an administrator

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

automation-controller: automation-controller-container: automation-controller: format string injection in the API 4XX error log setting discloses Django SECRET_KEY and database credentials to an administrator

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

CVE-2026-84691 Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an administrator

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

CVE-2026-84691 Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an administrator

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

CVE-2026-18461

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

CVE-2026-18461

The RTI Connext Professional (Core Libraries) is vulnerable to a Format String Injection flaw due to the Use of Externally-Controlled Format String . This vulnerability affects versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6 . An attacker could potentially exploit this to impact the con...

CVE-2026-18461 Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

EUVD-2026-84616

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

CVE-2026-18461 Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

CVE-2026-18461: Use of Externally-Controlled Format String

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

PT-2026-96891

Name of the Vulnerable Software and Affected Versions Connext Professional versions 7.5.0 through 7.7.0 Connext Professional versions 7.3.0.10 through 7.3.1.5 Description Use of an externally-controlled format string in the Core Libraries allows for Format String Injection. This occurs when an...