proxyshell

ProxyShell Proof of Concept Exploit for Microsoft Exchange CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 Details For background information and context, read the blog post detailing the research by Horizon3: https://www.horizon3.ai/news/blog/proxyshell Features No email address needs to be...

Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request

An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur. id: CVE-2025-32813 info: name: Infoblox NetMRI 7.6.1 - Unauthenticated Command Injection in getsamlrequest author: iamnoooob,pdresearch severity: high description: | An issue was discovere...

WP Hotel Booking <= 2.0.7 - SQL Injection

WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admininit, letting unauthenticated users perform SQL injections, exploit requires no authentication. id: CVE-2023-5652 info: name: WP...

VisualDoor

VisualDoor Exploit de SonicWall SSL-VPN, utilizado por Phineas Fisher para hackear el Cayman Trust Bank y Hacking Team. No autenticado, te da un shell de 'nobody'. Obtener root es un ejercicio para el usuario. Para más detalles ver:...

CyberPanel-RCE

CyberPanel-RCE Exploit para el RCE de CyberPanel encontrado en la v2.3.6 Más información disponible en mi blog: https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to values specified by the user, which determine the number of elements in the multi-bulk header and the size of each element in...

CVE-2026-64962

ATutor's profile update functionality lacks CSRF token validation, allowing an attacker to craft a malicious site that submits forged profile-modification requests when visited by an authenticated victim. CVSS 5.1 (Medium), network attack vector. ATutor is end-of-life; no fix exists—upgrade to a ...

CVE-2026-76048 SourceCodester Simple Online Food Ordering System ajax.php login sql injection

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

CVE-2026-46482

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

Linux Distros Unpatched Vulnerability : CVE-2026-20786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary wi...

EUVD-2026-58802

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-48435

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

CVE-2026-48375

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...

CVE-2026-62699

The CVE-2026-62699 entry concerns the Windows Universal Disk Format File System Driver (UDFS). It describes a heap-based buffer overflow in UDFS that permits code execution by an unauthenticated attacker with physical access to the system. Affected component: UDFS in Windows. Root cause: heap-bas...

CVE-2026-48442 CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside th...

CVE-2026-48435 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

CVE-2026-71389 CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

CVE-2026-48362

Technical details for CVE-2026-48362 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2026-66484

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

PT-2026-70354

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An Incorrect Authorization issue allows an attacker to execute arbitrary code in the context of the current user. The vulnerable component is restricted to an administrative network zone b...