EUVD-2026-70452

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors...

CVE-2026-78080

CVE-2026-78080 affects the JooDatabase Lite Joomla extension (feenders.de), versions below 5.1.0 . The root cause is the cid parameter being used in database queries without input validation, enabling an unauthenticated SQL injection attack over the network with low complexity and no user interac...

CVE-2021-44228

🛡️ CVE-2021-44228: Análisis de Log4Shell - La Vulnerabilidad que Revolucionó la Seguridad Java Impacto Crítico CVSS 10.0 | Descubierta en 2021, esta falla en Apache Log4j permite ejecución remota de código RCE y afecta a millones de sistemas globales. ¡Aún hoy, es un recordatorio clave para la...

CVE-2026-78000

J2Store , a Joomla e-commerce extension by j2commerce.com , is affected by two related issues. Four task handlers in the cart controller accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain (o...

EUVD-2026-70446

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the...

MongoBleed-DFIR-Triage-Script-CVE-2025-14847

Eric Capuano1 posted an excellent blog regarding MongoBleed CVE-2025-14847 and indicators to look out for. PoC by Joe Desimone2 shows exactly how the memory leak exploit works and Kevin Beaumont3 has an excellent write-up on the vulnerability see reference section for links. MongoBleed Triage...

Log4Shell-CVE-2021-44228-

Log4Shell CVE-2021-44228 - SOC रिपोर्ट विश्लेषण अवलोकन इस रिपॉजिटरी में Log4Shell CVE-2021-44228 का एक व्यापक सुरक्षा संचालन केंद्र SOC विश्लेषण शामिल है, जो 2021 में खोजी गई सबसे गंभीर कमजोरियों में से एक है। यह कमजोरी Apache Log4j लॉगिंग लाइब्रेरी को प्रभावित करती है और दुनिया भर के संगठनों के...

CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

CVE-2026-77999

J2Store (Joomla extension by j2commerce.com) versions 1.0.0–3.3.21, 4.0.0–4.0.21, and 4.1.0–4.1.6 contain an unauthenticated PayPal callback forgery vulnerability. The IPN listener's signature check (_validateIPN()) treated UNVERIFIED and any non-INVALID response as valid, issued verification wit...

EUVD-2026-70415

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

CVE-2026-78064 Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw...

CVE-2026-78064

CVE-2026-78064 affects the J2Store Joomla extension (j2commerce.com) in versions 1.0.0–3.3.21, 4.0.0–4.0.21, and 4.1.0–4.1.6 . The vulnerability stems from fof.xml granting the carts view a wildcard true ACL, while FOF enforces CSRF tokens only on back-end HTML requests—not on front-end format=ra...

CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA Cybersecurity Department | Offensive Security Internship 2026 Overview This project researches, replicates, and documents CVE-2018-7600 Drupalgeddon2 — a Critical CVSS 9.8 unauthenticated Remote Code Execution vulnerability in Drupal CMS,...

CVE-2026-33017-Langflop

CVE-2026-33017 Langflow "Langflop" Unauth RCE PoC PoC for the unauthenticated buildpublictmp code-execution flaw in Langflow. It uploads a malicious component to a public flow, triggers a build, and catches a reverse shell. For authorized security testing only. Use only against systems you own or...

ForgottenButNotGone

Forgotten but Not Gone This repository contains proof-of-concept scripts for the vulnerabilities presented at the talk "Forgotten but Not Gone: Unauthenticated RCEs and LPEs in Legacy Linux Services" from Black Hat USA 2026 and DEF CON 34. CVE-2026-28372 Local privilege escalation in TelnetD:...

CVE-2023-22527

CVE-2023-22527 - Atlassian Confluence Remote Code Execution Overview CVE-2023-22527 is a critical remote code execution vulnerability in Atlassian Confluence Data Center and Server. This vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable Confluence instances...

CVE-2026-80465

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.3, Mendix SAML Mendix 11 compatible All versions V4.2.3, Mendix SAML Mendix 9.24 compatible All versions V3.6.27. Affected versions of the module do not properly validate the SAML response signature. This...

EUVD-2026-70411

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.3, Mendix SAML Mendix 11 compatible All versions V4.2.3, Mendix SAML Mendix 9.24 compatible All versions V3.6.27. Affected versions of the module do not properly validate the SAML response signature. This...

CVE-2026-80465

CVE-2026-80465 affects the Mendix SAML module across multiple compatibility lines: Mendix 10 (all versions < V4.2.3), Mendix 11 (all versions < V4.2.3), and Mendix 9.24 (all versions

EUVD-2026-70394

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...