CVE-2026-14382

CVE-2026-14382 Bin trigger Bug fix root@kitploit: $250000492218546 High CVE-2026-14382: Insufficient validation of untrusted input in ANGLE. Reported by anonymous on 2026-03-13 The root cause of this vulnerability appears to be similar to that of CVE-2025-6558. Based on my current analysis, I...

CVE-2018-25031

CVE-2018-25031 CVE-2018-25031 exploits tests Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. HowTo Find the documentation endpoint a...

tetsuo-pulse

Socket Library Maturity Notice : This library is functional and well-tested but newly released. It is appropriate for development, internal tooling, and controlled environments. Production deployment with untrusted network input should wait until the codebase has accumulated several months of...

CVE-2022-42889-POC

CVE-2022-42889-POC Proof of Concept for the Apache commons-text vulnerability CVE-2022-42889. What's the Issue : Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefi...

commons-text-goat

Commons-Text Goat Esta es una aplicación web que es intencionalmente vulnerable a CVE-2022-42889. Utiliza un servidor Jetty embebido y Maven para iniciar un servlet que escucha en el puerto 8080 en la URL \api. Este endpoint acepta un parámetro URL cmd. Este se inserta entre $ y y se pasa a la...

nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy Una librería para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Compatible con Java 8+. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que proporcionan para ...

CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-

CVE-2026-21012 – Rust serde Deserialization of Untrusted Enum Variant Injection Program Code Rust root@kitploit: // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminAction ReadLogs,...

avscript

Avast Antivirus JavaScript Interpreter NOTE: On 03/11/2020 Avast announced they had decided to disable this interpreter globally! The main Avast antivirus process is called AvastSvc.exe, which runs as SYSTEM. That service loads the low level antivirus engine, and analyzes untrusted data received...

VUL4J-60

antisamy A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc., that get...

CVE-2023-32571

🐞 CVE-2023-32571 - System.Linq.Dynamic.Core Remote Code Execution Proof of Concept for CVE-2023-32571, a remote code execution vulnerability in System.Linq.Dynamic.Core 1.0.7.10 to 1.2.25. This vulnerability allows attackers to execute arbitrary code and commands when untrusted input to methods...

OHTS

OHTS CVE-2017-8759 | Vulnerabilidad de ejecución remota de código en .NET Framework 1. Introducción Existe una vulnerabilidad de ejecución remota de código cuando Microsoft .NET Framework procesa entradas no confiables. Un atacante que explotara con éxito esta vulnerabilidad en software que utili...

DEBIAN-CVE-2026-19248

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

CVE-2026-19248

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

EUVD-2026-80223

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

CVE-2024-22641

CVE-2024-22641 Tipo de Vulnerabilidad Denegación de Servicio por Expresión Regular ReDoS Producto y Versión Afectados TCPDF root@kitploit: AddPage; $pdf-ImageSVG$file='poc.svg'; ?...

CVE-2026-45579 DIRAC: RCE in RequestManager due to eval on untrusted input

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

CVE-2026-91942 crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

EUVD-2026-77634

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...