CVE-2026-103974 lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...

CVE-2026-103974

The chess server lichess.org is vulnerable to Stored HTML Injection in its study features. An attacker who can add a chapter to a study can place malicious text within the PGN Annotator tag , which is then stored as Comment.Author.External. When a study node contains at least two comments, the fi...

CVE-2026-110638

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog or tag. Attackers can embed $... or backtick command substitution in the file path, which DocData.readPDF passes to a shell-based pdftotext...

EUVD-2026-101266

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog or tag. Attackers can embed $... or backtick command substitution in the file path, which DocData.readPDF passes to a shell-based pdftotext...

CVE-2026-110638

The doc-recog library (through version 1.1.6 ) is vulnerable to an OS command injection vulnerability. The flaw exists because the DocData._readPDF function passes unvalidated document paths from the recog() or tag() functions to a shell-based pdftotext execution call. Attackers can exploit this ...

CVE-2026-110638 doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog or tag. Attackers can embed $... or backtick command substitution in the file path, which DocData.readPDF passes to a shell-based pdftotext...

K000163699: OpenSSL vulnerability CVE-2026-75803

Security Advisory Description Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on ...

CVE-2026-90186

A flaw was found in the Linux kernel's nullblk module. A local user can cause a system crash by attempting to resize device queues while a shared tag set is active. This improper handling of queue resizing leads to a null pointer dereference, which can result in a denial of service...

CVE-2026-20251

CVE-2026-20251 — Splunk Secure Gateway jsonpickle Deserialization RCE Researcher: Fady Oueslati · ReactiveZero Security Research Reference: 2026FO-SPLUNK-20251 CVSS: 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Status: Open — patch available Summary A low-privileged authenticated user can...

Pwn ARM NFC

Challenge ARM buffer overflow via NFC tag This project is an open-source and funny to make low-level challenge. Feel free to improve it or use it in your own projects. Each file is distributed "as is" in the hope that it will be useful, but without any warranty expressed or implied. File tree...

CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content

CSZ CMS Stored XSS v1.3.0 Author: Sergio CVE: 2023-41436 Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component. Attack Vectors:...

CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass

CVE-2026-49230 — Apache APISIX jwe-decrypt Authentication Bypass Proof of concept for an authentication bypass in the Apache APISIX jwe-decrypt plugin. The plugin decrypts a JWE token and forwards its plaintext to the upstream, acting as an authentication gate — but it never validates the AES-GCM...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...

CVE-2023-27372-PoC

This PoC was wrote quickly, it's nothing special. This exploits the new CVE-2023-27372 SPIP RCE vulnerability. It's a deserilzation flaw which exploits the dangerous use of ENV tag during the reset password feature spip.php?page=spippass within "/ecrire/balise/formulaire.php" Specifically this...

cve-2023-30253

CVE-2023-30253 Description Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: ?PHP instead of ?php in injected data. Documentation CVE-2023-30253 GitHub Advisory: GHSA-9wqr-5jp4-mjmh Setup git clone...

CVE-2026-21045_and_CVE-2026-21048

CVE-2026-21045 & CVE-2026-21048 — Samsung libimagecodec.quram.so OOB Write PoC Overview This repository contains conceptual Proof-of-Concept PoC files that demonstrate out-of-bounds OOB write vulnerabilities in the Quramsoft image codec library libimagecodec.quram.so used on Samsung Android...

claude-XML-injection

Claude Sonnet 4.6 — Credential Fabrication via XML Tag Injection Reported: June 14, 2026 | Patched: June 20, 2026 | Anthropic Response: None 56 days Researcher: X1NON Affected Model: Claude Sonnet 4.6 and other non-Haiku Claude models Severity: High CVSS 8.7 Status: Patched — No bounty awarded, n...

PoC_CVE-2025-54887

PoCCVE-2025-54887 This repository contains Proof-of-Concept PoC exploit for CVE-2025-54887. This is a vulnerability in ruby-jwe version = 1.1.0 where the authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality and provide ways to craft arbitrary JWEs...

CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Vulnerability Type: Cross-Site Scripting XSS – Reflected XSS CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Severity: High CISA ADP CVSS v3.1: 7.1 Overview CVE-2026-9833 affects the Tag Groups – Advanced Way to...

poro

poro Descripción Escanea activos accesibles públicamente en tu entorno de AWS Servicios cubiertos por esta herramienta: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro también verifica si una etiqueta que especifiques está aplicada en los recursos públicos...