CVE-2022-42889-POC

CVE-2022-42889-POC Preuve de concept pour la vulnérabilité Apache commons-text CVE-2022-42889. Quel est le problème : Apache Commons Text effectue une interpolation de variables, permettant d'évaluer et d'étendre dynamiquement des propriétés. Le format standard pour l'interpolation est...

nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy Библиотека для быстрой и настраиваемой очистки HTML, поступающего из ненадёжных источников. Другими словами, это API, который помогает убедиться, что клиенты не передают вредоносный код в HTML, который они предоставляют для своего профиля, комментариев и т.д. и который сохраняется на...

CVE-2019-14319

creationtimestamp| type| source ---|---|--- 2026-08-29 23:00:08+00:00| seen| Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxyXdixQ 2026-08-30 00:00:12+00:00| seen| Telegram/lHKFDBRntVLEnzL4VqEuPiY-Vt8pAa9hTd9KwEhxyXdixQ 2026-08-31 00:00:46+00:00| published-proof-of-concept|...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-

CVE-2026-21012 – Rust serde: deserializzazione di enum non attendibile Iniezione di variante Codice del programma Rust root@kitploit: // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminActio...

seans-surf-and-skate

Sean's Surf & Skate Co. — Demo di Seal Security Maven / Java Un piccolo negozio di e-commerce dall'aspetto realistico "Sean's Surf & Skate Co." realizzato con Spring Boot. Include dipendenze open-source note per essere vulnerabili così da poter essere usato per dimostrare come Seal Security risan...

BIT-APISIX-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2026-80671

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

OHTS

OHTS CVE-2017-8759 | .NET Framework रिमोट कोड निष्पादन भेद्यता 1. परिचय एक रिमोट कोड निष्पादन भेद्यता तब मौजूद होती है जब Microsoft .NET Framework अविश्वसनीय इनपुट को संसाधित करता है। एक हमलावर जो .NET फ्रेमवर्क का उपयोग करने वाले सॉफ़्टवेयर में इस भेद्यता का सफलतापूर्वक शोषण करता है, वह प्रभावित...

CVE-2026-80670 perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology in machineresolve machineresolve accesses env-cpual-cpu.socketid after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nrcpusavail. Since al-cpu comes from...

CVE-2026-80671 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix registerpid overflow, strcpy, and BUGON registerpid has several issues when processing untrusted perf.data: 1. Integer overflow: pid + 1 sizeofstruct taskdesc can wrap to a small value on 32-bit systems when pid i...

CVE-2024-22641

CVE-2024-22641 Tipo de Vulnerabilidade Negação de Serviço por Expressão Regular ReDoS Produto e Versão Afetados TCPDF root@kitploit: AddPage; $pdf-ImageSVG$file='poc.svg'; ?...

avscript

Avast Antivirus JavaScript-Interpreter HINWEIS: Am 03.11.2020 gab Avast bekannt, dass sie beschlossen hatten, diesen Interpreter global zu deaktivieren! Der Hauptprozess des Avast-Antivirenprogramms heißt AvastSvc.exe und wird als SYSTEM ausgeführt. Dieser Dienst lädt die Low-Level-Antiviren-Engi...

commons-text-goat

Commons-Text Goat Questa è un'applicazione web intenzionalmente vulnerabile a CVE-2022-42889. Utilizza un server Jetty incorporato e Maven per avviare un servlet in ascolto sulla porta 8080 all'URL \api. Questo endpoint accetta un parametro URL cmd. Questo viene inserito tra $ e e passato alla...

nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy Una libreria per eseguire una pulizia veloce e configurabile di HTML proveniente da fonti non affidabili. Supporta Java 8+. Un altro modo per dirlo potrebbe essere: è un'API che ti aiuta a garantire che i client non forniscano codice malevolo malicious cargo code nell'HTML che forniscono...

CVE-2026-80179

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-81522

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

DEBIAN-CVE-2026-81522

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

CVE-2026-81525

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...