CVE-2026-105468

The girishsaraf Online-Appointment-Booking-System is vulnerable to a SQL injection flaw within the Login Handler component, specifically affecting the mysqli_query function in the Admin/mlogin.php file. An attacker can initiate a remote attack by manipulating the uname or pass arguments. While th...

AZL-105959 CVE-2026-105773 affecting package clamav 1.5.4-2

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

CVE-2026-105773

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

EUVD-2026-92797

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

CVE-2026-105773 Canimaan Software ClamXAV local privilege escalation

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

CVE-2026-54424

CVE-2026-54424 استغلال Parsec لإصدارات Windows الأقل من 150-104a للحصول على: تنفيذ تعليمات برمجية عن بُعد بصلاحيات SYSTEM قراءة ملف عشوائية بصلاحيات SYSTEM التقاط هاش NTLM لصلاحيات SYSTEM تنبع عمليات الاستغلال من نفس الثغرة، لكن المسارات الفعلية تختلف. شرح تقني:...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb version 6.1.2.0 ou inférieure contient une vulnérabilité d'exécution de code à distance RCE dans sa fonctionnalité Notification Settings. Un attaquant authentifié disposant des privilèges "System Settings" dans ASWeb peut exploiter cette faille...

CVE-2026-105679

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105650

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulti...

CVE-2021-39408

CVE-2021-39408 توجد ثغرة Cross Site Scripting XSS انعكاسية في إصدارات متعددة من الإصدار 1.0 من تطبيق Online Student Rate System، والتي تسمح بتنفيذ أوامر JavaScript بشكل تعسفي. الصفحة المعرضة للثغرة على index.php، تكون المعامل page معرضًا للثغرة، مما يسمح للمهاجم بتضمين أي كود JavaScript داخل وسوم...

log4shell

log4shell نص برمجي بلغة Python لفحص نظام ملفات الخادم بحثًا عن ملفات log4j jar المعرضة للثغرات CVE-2021-44228 و CVE-2021-45046. يمر النص البرمجي عبر نظام الملفات بشكل متكرر بما في ذلك zip و ear و war للعثور على إصدارات log4j من 2. إلى 2.15 التي تحتوي على...

CVE-2026-89867

A flaw was found in the Linux kernel's media subsystem, specifically within the chips-media wave5 driver. This vulnerability occurs when multiple video decoder instances share a video processing unit VPU and a job slot is not properly released during the draining process, particularly if a decode...

Exploit for Injection in Dlink Dir-868L_B1_Firmware

CVE-2025-14659: D-Link DHCP Hostname Command Injection An Off...

CVE-2026-90015

A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface driver. This vulnerability occurs when the driver processes large, fragmented USB data transfers, leading to incorrect handling of memory buffers. An attacker with local access or a malicious USB device could exploit...

CVE-2026-93185

A flaw was found in the Linux kernel's audio subsystem, specifically within the SoundWire SDW driver for the rt700 codec. This vulnerability arises when a SoundWire device is removed, as the system may fail to properly cancel all pending tasks associated with the device. Consequently, an active...

CVE-2026-49878

In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-105387

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

CVE-2019-16098

CVE-2019-16098 This CVE exploits the RTCore64.sys driver and creates a cmd.exe process with system privileges by copying the token of the System process with one of the low-privilege cmd.exe process. Blog about the approach and the methodology can be found here...

CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - تضمين الملفات المحلية الوصف : Customer Support System 1.0 عرضة لثغرة تضمين الملفات المحلية Local File Inclusion. يمكن للمستخدم المُصادَق عليه الوصول إلى ملفات PHP وقراءتها من نظام التشغيل عبر استغلال ثغرة تضمين الملفات المحلية LFI من خلال مرشح الغلاف...

CVE-2023-49987

CVE-2023-49987 School Fees Management System v1.0 - ثغرة في البرمجة النصية عبر المواقع XSS في معامل "tname" في "newterm" الوصف : تسمح ثغرة في البرمجة النصية عبر المواقع XSS في المكون "newterm" من School Fees Management System 1.0 للمهاجمين بتنفيذ نصوص برمجية عشوائية أو HTML عبر إدخال حمولة خبيثة ...