CVE-2026-8888-Printer-Firmware-Unsigned-Update-via-HTTP

CVE-2026-8888 – Printer Firmware Unsigned Update via HTTP Program Code Python HTTP server + printer emulator !/usr/bin/env python3 printerfirmwareserver.py - Simulated printer that fetches updates over HTTP import requests, hashlib, os FIRMWAREURL = "http://updates.printer.local/firmware.bin"...

CVE-2025-14221

Description 1. CVE-2025-14221 2. Discoverer: Fatma Trabelsi 3. Vendor of Product: SourceCodester 4. Affected Product: Online Banking System 1.0 POC A Stored Cross-Site Scripting XSS vulnerability exists in the User Profile Update functionality of the application. The application fails to properly...

gosign-desktop-exploit-poc

Multiple Vulnerabilities in GoSign Desktop leads to Remote Code Execution Name: TLS Verification Bypass and Insecure Update in GoSign Desktop CVEs: CVE-2025-34324, CVE-2025-34327 System Affected: GoSign Desktop = 2.4.0 Fix: FoSign Desktop 2.4.1 partially fixed Vendor: Tinexta InfoCert S.p.A...

Security update for rclone (important)

openSUSE Security Update: Security update for rclone Announcement ID: openSUSE-SU-2026:0354-1 Rating: important References: 1279548 Cross-References: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-46603 CVE-2026-56853 CVE-2026-56854 CVE-2026-56855 CVE-2026-56858 CVE-2026-56859 CVE-2026-568...

nodejs:22 security update

nodejs 1:22.23.2-2.0.1 - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder - Expose the block-switch error and add malformed-stream regression coverage - Require the fixed Oracle Linux 8 system Brotli build nodejs-nodemon nodejs-packaging...

CVE-2026-107092

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint...

EUVD-2026-109893

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint...

CVE-2026-107092

The software NexoPOS v6.2.4 is vulnerable to a Directory Traversal flaw located in the api/update endpoint. This vulnerability allows an attacker to potentially access files or directories outside of the intended web root. While the technical impact is rated as CRITICAL with a CVSS score of 9.8 ,...

CVE-2020-25540

cve-2020-25540 This script is used to exploit arbitrary file read vulnerabilities in ThinkAdmin v5 and v6 versions ==Note that the interface path may vary across different versions some are based on the original ThinkAdmin with secondary development== The original interface is:...

CVE-2023-23397

CVE-2023-23397 Patch for MS Outlook Critical Vulnerability - CVSS 9.8 3 PowerShell scripts are included in the Patch folder. If your patch management software uses an evaluation and a remediation script, use the respective files/scripts. The All In One script will evaluate the current version of...

CVE-2017-9606

CVE-2017-9606 Due to insufficient of checking integrity, authenticity and low user rights on update folder local user can craft fake ViPNet update files with arbitrary execution code and place them in ViPNet update folder. After placing fake update files in ViPNet update folder, ViPNet update...

CVE-2026-22017-Firmware-Update-via-BLE-Without-Authentication

CVE-2026-22017 – Firmware Update via BLE Without Authentication Program Code Python bleak peripheral blefirmwareupdate.py - Simulated BLE peripheral accepting firmware writes from bleak import BleakServer, BleakGATTCharacteristic import asyncio class FirmwareService: def initself: self.firmwareda...

CVE-2024-50490

CVE-2024-50490 PegaPoll = 1.0.2 - Unauthenticated Arbitrary Options Update Description: The PegaPoll plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in all versions up to, and including, 1.0.2. This...

CVE-2024-23339

CVE-2024-23339 취약점 개요 CVE-2024-23339 CVSS : 6.5 Jan 23, 2024 ProtoType Pollution in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utilit...

Statement

Statement Regarding the CVE-2021-36593 and CVE-2021-36594, I would like to mention that I only had submitted a request to split the CVE-ID. 2 years ago The CVE-IDs will be published in the coming months as there is currently no available update. We have postponed the publishing process for the ti...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Broken Access Control LiteLLM 's /config/update endpoint does not check the caller's role privileges. Any authenticated user with a valid API Key without admin privileges can modify the proxy configuration, register malicious Pass-Through endpoints to achie...

UsoDllLoader

UsoDllLoader ⚠️ 2020-06-06 Update: this trick no longer works on the latest builds of Windows 10 Insider Preview. This means that, although it still works on the mainstream version of Windows 10 , you should expect it to be patched in the coming months. Description This PoC shows a technique that...

CVE-2026-49060-Lab

CVE-2026-49060 - Hippoo Mobile App for WooCommerce Incorrect Privilege Assignment / Privilege Escalation Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-49060, an Incorrect Privilege Assignment vulnerability affecting the WordPress plugin Hipp...

CVE-2023-33246_RocketMQ_RCE_EXP

CVE-2023-33246RocketMQRCEEXP CVE-2023-33246 RocketMQ Remote Code Execution Exploit Overview RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this...

PcanExploit

CVE-2024-44610: PEAK PCAN-Ethernet Gateway FD DR Authenticated Root Exploit What is it? This repository contains a Proof-of-Concept PoC exploit that executed code as root on Peak Ethernet gateways. It requires that you know the credentials to the web interface. How to fix it? The vendor has rapid...