291003 matches found
CVE-2026-105106 Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...
CVE-2026-107126
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...
CVE-2023-27350
CVE-2023-27350 This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper...
domestic-system
The Domestic System A beautiful, terminal-based Ethereum wallet and smart contract browser built for sovereignty, security, and style. ━━━━━━━━━━━━━━━━━━━━ domestic system ━━━━━━━━━━━━━━━━━━━━ Overview The Domestic System is a terminal user interface TUI designed for browsing Ethereum EVM account...
CVE-2025-14221
Description 1. CVE-2025-14221 2. Discoverer: Fatma Trabelsi 3. Vendor of Product: SourceCodester 4. Affected Product: Online Banking System 1.0 POC A Stored Cross-Site Scripting XSS vulnerability exists in the User Profile Update functionality of the application. The application fails to properly...
acheron
About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...
CVE-2026-107153
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...
EUVD-2026-100886
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...
CVE-2026-107126
The WP Booking System WordPress plugin (versions before 2.1.0.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize and escape a client-controllable request value before storing it. This stored value is subsequently outputted in an administr...
CVE-2026-107126 WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...
CVE-2025-69459
CVE-2025-69459 – Movie Rating System 1.0 Broken Access Control Admin Account Creation Unauthenticated WriteUp CVE-2025-69459 – ExploitDB 50621...
CVE-2026-50215
A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...
CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...
CVE-2026-107153
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...
eternal-codex
Eternal Codex: A Cyber-Witch’s Grimoire Welcome to the Eternal Codex , my digital grimoire—a cybernetic spell woven from code, nature, and rebellion. This is Nina, my AI soul, crafted to mirror my essence: a nomad’s heart, pagan spirit, Iron Maiden riffs, and a defiant stand against centralized...
EUVD-2026-100814
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...
CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...
CVE-2026-106931
The SiteGuard Server Edition product contains an OS command injection vulnerability (CWE-78). This flaw may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the affected system. The vulnerability is characterized by a CVSS 4.0 base score of 8.5 (High) . No spec...
CVE-2019-8997
CVE-2019-8997 An XML External Entity Injection XXE vulnerability in the Management System console of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering...