113144 matches found
CVE-2026-92602
TDuck survey form through version 5.3 is affected by a Server-Side Request Forgery vulnerability in the WebhookConfigController . The root cause is a failure to validate webhook URLs or verify form ownership, allowing authenticated attackers to attach webhooks to other users' forms and exfiltrate...
HeartBleed-Vulnerability-Checker
HeartBleed-Vulnerability-Checker author = 'WaQas-JaMal' Быстрая и грязная демонстрация CVE-2014-0160 от Джареда Стаффорда [email protected] и автор отказывается от авторских прав на этот исходный код. ''' Я модифицировал этот скрипт, чтобы он принимал любой входной файл со списком URL...
CVE-2015-1635_PoC
использование: python3 CVE-2015-1635PoC.py например: python3 CVE-2015-1635PoC.py http://www.xxx.com...
CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...
grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal
A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...
CVE-2026-92141
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-92135
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...
CVE-2026-74909
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...
CVE-2026-92141
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-92141
The Jenkins Keycloak Authentication Plugin versions 2.4.1 and earlier do not restrict the redirect URL after login. An attacker can craft a Jenkins URL that, after a successful authentication, forwards the user to an arbitrary external site, enabling phishing attacks . The vulnerability is classi...
EUVD-2026-80765
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-92135
Jenkins Coverage Plugin versions 3.3358.v9487dde48783 and earlier do not validate the coverage results ID when a job configuration is submitted through the REST API. Attackers with Item/Configure permission can use a javascript: scheme URL as the identifier, resulting in a stored cross-site scrip...
EUVD-2026-80759
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...
CVE-2026-92134
Jenkins Warnings Plugin (warnings-ng) version 13.10258.va_17d49a_78c3b_ and earlier fails to validate the analysis results ID when a job configuration is submitted through the REST API. An attacker with Item/Configure permission can inject a javascript: scheme URL as the identifier, resulting in ...
lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...
Important: Red Hat Security Advisory: python-lxml security update
An update for python-lxml is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
CVE-2025-20384
SPLUNK CVE-2025-20384 я не знаю, я просто читаю то, что друг мне прислал, и начинаю набирать какой-то случайный жалкий код на javascript POC типа Log Injection/Forgery/Poisoning/Obfuscate Пожалуйста, прочитайте эту статью OWASP Log Injection TL;DR Найдите статический файл, передайте его и добавьт...
CVE-2025-21385
SSRF Exploit Script Этот репозиторий содержит скрипт, предназначенный для выполнения эксплуатации SSRF Server-Side Request Forgery в целях тестирования и обучения. Используйте этот инструмент ответственно и только в средах, где у вас есть явное разрешение. Возможности Эксплуатация уязвимостей SSR...