Changedetection.io <=v0.45.21 - Cross-Site Scripting

Changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notificationurls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when...

Nagios XI < 5.11.3 - SQL Injection

SQL injection vulnerability in Nagios XI before version 5.11.3 via the bulk modification tool. id: CVE-2023-48084 info: name: Nagios XI 5.11.3 - SQL Injection author: ritikchaddha severity: critical description: | SQL injection vulnerability in Nagios XI before version 5.11.3 via the bulk...

Qwik - Unauthenticated RCE via server$ Deserialization

Qwik =1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require availability at runtime. id: CVE-2026-27971 info: name: Qwik - Unauthenticated RCE via server$ Deserialization...

CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF 脆弱性 📌 概要 CVE-2026-44578 は、セルフホスト型 Next.js アプリケーションに影響を与える 高深刻度のサーバーサイドリクエストフォージェリ SSRF 脆弱性です。 攻撃者は細工された WebSocket Upgrade リクエスト を悪用して、サーバーに内部または外部システムへのアウトバウンドリクエストを強制することができます。 ⚠️ 影響 この脆弱性により、攻撃者は以下にアクセスできる可能性があります： 対象| リスク ---|--- 🔐 内部API| 内部への不正アクセス ☁️...

CVE-2026-44578-next-js-ssrf

CVE-2026-44578 — Next.js WebSocket 升级 SSRF（实验室） 自包含实验室，用于复现 Next.js 自托管 应用中使用内置 Node.js 服务器时的 CVE-2026-44578 （CWE-918，SSRF）漏洞。...

cacti-cve-2023-39361

Cacti ™ 从 develop 分支运行 Cacti 重要提示 当使用源码或直接从仓库下载代码时，如果您遇到任何关于数据库中缺少表或列的报错，务必运行数据库升级脚本。 数据库的变更会提交到 cacti.sql 文件中，该文件用于全新安装，同时也会提交到安装程序的数据库升级中，用于现有安装。由于在 develop 分支中版本号在发布前不会改变，这会导致数据库升级无法运行，因此务必使用数据库升级脚本强制当前版本，或更新数据库中的版本号。 从 Cacti 1.x 之前的版本升级 当 Cacti 在近 20 年前最初开发时，MySQL 还没有像现在这样成熟。当 The Cacti Group...

CVE-2026-44578-PoC

CVE-2026-44578 - PoC de SSRF en WebSocket de Next.js Vulnerabilidad: Falsificación de solicitudes del lado del servidor en el manejador de actualización WebSocket de Next.js 13.4.13 → 15.5.15, 16.0.0 → 16.1.6 Uso root@kitploit: Detect vulnerability python3 poc.py target.com:3000 --detect Tunnel t...

ngrep

ngrep 1.49.0 2.7.2026 ngrep es como GNU grep aplicado a la capa de red. Es una herramienta basada en PCAP que permite especificar una expresión regular extendida o hexadecimal para comparar con las cargas útiles de datos de los paquetes. Comprende muchos tipos de protocolos, incluidos IPv4/6, TCP...

PT-2026-91208

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService e.g. BackupService::deleteBackup concatenate the user-supplied backup file/filename value directly onto the backup directory path without...

Apache Druid - Server-Side Request Forgery

Server-Side Request Forgery SSRF, Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting', URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request tha...

Cisco IOS HTTP Configuration - Authentication Bypass

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. id: CVE-2001-0537 info: name: Cisco IOS HTTP Configuration - Authentication Bypass author:...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. id: CVE-2021-26702 info: name: EPrints 3.4.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: EPrints 3.4.2 contains a reflected cross-site...

Zend Server <9.13 - Cross-Site Scripting

Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. id: CVE-2018-10230 info: name: Zend Server 9.13 - Cross-Site Scripting author: marcosiaf severity: medium description: | Zend Server before version 9.13 is vulnerable to cross-site scripting via the...

FUEL CMS 1.4.1 - Remote Code Execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. id: CVE-2018-16763 info: name: FUEL CMS 1.4.1 - Remote Code Execution author: pikpikcu severity: critical description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/...

CouchCMS <= 2.0 - Path Disclosure

CouchCMS = 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. id: CVE-2018-7662 info: name: CouchCMS = 2.0 - Path Disclosure author: ritikchaddha severity: medium description: CouchCMS = 2.0 allows...

CandidATS 3.0.0 - Cross-Site Scripting

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the page parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection

Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...

Roxy-WI - Remote Code Execution

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands. id: CVE-2022-31161 info: name: Roxy-WI - Remote Code...

Essential Blocks < 4.4.3 - Local File Inclusion

Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site. id: CVE-2023-6623 info: name: Essential Blocks 4.4.3 - Local File...