CVE-2023-39062

CVE-2023-39062 Spipu Html2Pdf alertdocument.domain HTTP/1.1 Host: example.afine.com Cookie: PHPSESSID=oiqo2oopiqt88teqgfb0a23vk0 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:109.0 Gecko/20100101 Firefox/113.0 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate...

Shopware < 5.5.8 - Cross-Site Scripting

Shopware before 5.5.8 contains a reflected cross-site scripting XSS caused by unsanitized query string parameters in the backend/Login or backend/Login/load/ URI, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires sending crafted URL to the victim...

CVE-2024-43018

CVE-2024-43018 ID 할당 CVE - Mitre에 공식 등록됨 목차 설명 사용된 기술 소스 및 싱크 실행 방법 수정 작성자 설명 논문 https://hdl.handle.net/10316/118126 및 https://hdl.handle.net/10316/118059 연구 중 Piwigo 애플리케이션에서 새로운 취약점이 발견되었습니다. 이 취약점은 HOST/admin.php?page=userlist 지점의 필터링된 검색에서 일부 매개변수에 대한 검증새니타이제이션 부재로 인해 발생합니다. 보다 구체적으로, Piwigo...

pgAdminOpendoor

pgAdminOpendoor CVE-2025-2945 개요 이것은 CVE-2025-2945에 대한 제 연구입니다. 이 저장소에는 postgress와 취약한 pgadmin이 포함된 테스트 스탠드와 익스플로잇이 포함되어 있습니다. CVE 유용한 링크: NVD 세부 정보 WIZ 분석 Metasploit 분석 Python으로 작성된 pgAdmin 백엔드에는 적절한 입력 검증이 부족한 두 개의 엔드포인트가 있습니다. 엔드포인트는 다음과 같습니다: /sqleditor/querytool/download - querycommited 매개변수...

CVE-2026-74236 GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlinkoremailfile function accepts parameters prefixed with vfilerow and appends their values directly to a base directory path without sanitizing for directory traversal...

CVE-2026-56126 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script

ServiceNow CVE-2025-11449 및 CVE-2025-11450 완화 스크립트 개요 이 스크립트는 ServiceNow UI 매크로에서 CVE-2025-11449 및 CVE-2025-11450 보안 취약점을 자동으로 탐지하고 수정합니다. 이러한 취약점은 사용자가 제어하는 sysparm 매개변수가 제대로 삭제되지 않을 경우 특수하게 제작된 링크를 통해 사용자 브라우저에서 임의 코드 실행을 허용할 수 있습니다. 영향을 받는 UI 매크로 $pwdverifyemail $pwdverifypersonaldataui 이 스크립트...

CVE-2025-49132-PoC

CVE-2025-49132-PoC Proof-of-Concept для CVE-2025-49132 — удаленное выполнение кода в Pterodactyl Panel -m check Do something funny python3 poc.py -u -m exploit -p -t Технические детали Анализируя git diff файла LocaleController.php между версиями v1.11.10 и v1.11.11 ссылка, мы видим, что контролл...

CVE-2026-59111

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

EUVD-2026-68596

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

CVE-2026-75333

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

CVE-2026-75333

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

CVE-2026-75333

yx-image-recognition v1.0 contains a Path Traversal vulnerability where parameters such as dir and filePath are passed directly to new File() for file system operations without any path sanitization or whitelist validation. The CVSS 3.1 score is 7.5 (High) , reflecting a network vector with no pr...

EUVD-2026-51410

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...

EUVD-2026-48713

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-57308

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

PT-2026-61606

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description An administrator with adequate entitlements can execute arbitrary SQL via stacked queries...

CVE-2026-58195 Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

CVE-2026-58195 Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

CVE-2026-58195

Agentic-Flow (MCP server tools) prior to version 2.0.14 is vulnerable to OS command injection. In affected code paths, tool parameters such as agent, task, name, language, and agentdb could be interpolated directly into shell command strings passed to execSync(), enabling arbitrary command execut...