11791 matches found
EUVD-2026-119377
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority...
WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting
The Tag Groups WordPress plugin 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with editpages capability, exploit requires victim interaction...
WordPress < 4.8.2 - Authenticated Open Redirect
WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface. id: CVE-2017-14725 info: name: WordPress 4.8.2 -...
Xinuo Openserver 5/6 - Cross-Site scripting
Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...
vk-geosearch
vk-geosearch Search for photos by geo-tags on the social networkvk.com Dependencies requests Installation git clone https://github.com/yevgen2020/vk-geosearch.git pip3 install requests cd vk-geosearch chmod +x search.py Usage To search for photos in VK, you need a service access key or a token...
Pwn ARM NFC
Challenge ARM buffer overflow via NFC tag This project is an open-source and funny to make low-level challenge. Feel free to improve it or use it in your own projects. Each file is distributed "as is" in the hope that it will be useful, but without any warranty expressed or implied. File tree...
CVE-2023-27372-PoC
This PoC was wrote quickly, it's nothing special. This exploits the new CVE-2023-27372 SPIP RCE vulnerability. It's a deserilzation flaw which exploits the dangerous use of ENV tag during the reset password feature spip.php?page=spippass within "/ecrire/balise/formulaire.php" Specifically this...
tiny_tracer
tinytracer A Pin Tool for tracing: API calls, including input and output of selected functions defined local functions, and functions from statically linked libraries selected instructions: RDTSC, CPUID, INT inline system calls, including parameters of selected syscalls transition between section...
CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass
CVE-2026-49230 — Apache APISIX jwe-decrypt Authentication Bypass Proof of concept for an authentication bypass in the Apache APISIX jwe-decrypt plugin. The plugin decrypts a JWE token and forwards its plaintext to the upstream, acting as an authentication gate — but it never validates the AES-GCM...
tfsec
📣 tfsec to Trivy Migration As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations...
auto_re
AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...
EUVD-2026-119148
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the createuser function within the anonymous-use...
CVE-2026-116751
The Amelia Pro plugin for WordPress (versions up to and including 9.9.1 ) is vulnerable to an unauthenticated time-based SQL Injection . The flaw exists because the plugin fails to sufficiently escape the 'tag[]' parameter array keys , which are not handled by WordPress's wp_magic_quotes. These u...
EUVD-2026-119142
The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag array KEYS' parameter in all versions up to, and including, 9.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
PT-2026-139430
The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag array KEYS' parameter in all versions up to, and including, 9.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
CVE-2026-123335
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection...
EUVD-2026-118099
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection...
CVE-2026-123335
JetBrains YouTrack versions before 2026.2.19562, 2026.1.14137, and 2025.3.169041 are affected by a missing authorization vulnerability (CWE-862). This flaw allows an attacker to attach tags to any issue via the tag issues collection. The vulnerability results in a LOW base severity (3.5) with an ...
