142 matches found
CVE-2024-1112
CVE-2024-1112 Este es un PoC que escribí para la vulnerabilidad de desbordamiento de montón en "ResHacker.exe". Uso Ejecuta CVE-2024-1112.py, copia toda la cadena del payload.txt creado y úsala como parámetro para abrir ResHacker.exe ResHacker.exe $string NOTA: No olvides encontrar la dirección...
CVE-2024-5961
CVE-2024-5961 Reflected XSS in 2ClickPortal Version: from 7.2.31 through 7.6.4. intext:"Powered by 2ClickPortal" PoC https://domain/szukaj/?searchlang=pl&search=all&string=" onfocus=alert1 autofocus="...
CVE-2026-88020
Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...
CVE-2026-88020
Autonomy Logic OpenPLC Runtime v3 is susceptible to an improper neutralization of input during web page generation vulnerability. This occurs because the web interface fails to encode a query string parameter used for program routing. Successful exploitation could allow an attacker to hijack sess...
EUVD-2026-84871
Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...
CVE-2026-88020 Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3
Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...
CVE-2026-88020: Improper Neutralization of Input During Web Page Generation
Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...
CVE-2026-92554
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-92554 ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...
EUVD-2026-82747
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-92554: Improper Neutralization of Input During Web Page Generation
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-75164
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...
CVE-2026-75164
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...
CVE-2026-75164
The MBS-Solutions X-Serie Gateway is affected by an arbitrary file read vulnerability in the /cgi-bin/ugwdownload.cgi component of firmware version V6_00_05 . A remote authenticated user with a low-privileged Standard role can exploit this by using the file query string parameter to retrieve arbi...
CVE-2026-75164
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...
PT-2026-78432
Name of the Vulnerable Software and Affected Versions HumHub Community Edition version 1.18.4 Description A reflected cross-site scripting issue exists in the Space membership-request workflow. An attacker can inject malicious button configuration into the options query-string parameter of the...
CVE-2026-66832
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
PT-2026-70927
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...