298242 matches found
CVE-2026-79820: Improper Authentication
A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...
Apache Submarine 0.8.0 Authentication Bypass / Remote Code Execution
Summary Apache Submarine Submarine for short is an End-to-End Machine Learning Platform to allow data scientists to create end-to-end machine learning workflows. On Submarine, data scientists can finish each stage in the ML model lifecycle, including data exploration, data pipeline creation, mode...
PT-2026-106177
Name of the Vulnerable Software and Affected Versions Ghost versions 6.34.0 through 6.66.0 Description Embed cards in the editor allow staff users, including those with Contributor roles, to bypass protections against stored cross-site scripting XSS. This occurs when scripts are stored in post...
HPESBHF05163 rev.1 - HPE Integrated Lights-Out (iLO) 7 Using COM, User Validation Failure Vulnerability
Potential Security Impact: Remote: User Validation Failure SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 7 iLO 7 1.25.00 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-79820 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H ...
CVE-2026-104890: Unrestricted Upload of File with Dangerous Type
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...
PT-2026-106016
Name of the Vulnerable Software and Affected Versions ApiAdmin versions prior to 5.1 Description SQL Injection occurs in the user-list endpoint "/admin/User/getUsers" through the gid parameter. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for executio...
CVE-2026-105652: Observable Discrepancy
Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...
CVE-2026-103511: External Control of File Name or Path
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...
CVE-2026-105229: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This issue affects some unknown processing of the file signup.php of the component User Registration Endpoint. Executing a manipulation of th...
PT-2026-104720
A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This issue affects some unknown processing of the file signup.php of the component User Registration Endpoint. Executing a manipulation of th...
...[ More ]
Apache Submarine retired to the Apache Attic suffers from an authentication bypass leading to unauthenticated remote code execution. The security filter CommonFilter.isProtectedApi treats any request whose User-Agent header matches the Python SDK pattern as not requiring authentication, and the...
CVE-2026-88397: Undefined Security Weakness
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter...
CVE-2025-24011-PoC
إثبات المفهوم لـ CVE-2025-24011 بناءً على https://github.com/advisories/GHSA-hmg4-wwm5-p999 تم اختبار هذه الأداة على إصدارات Umbraco 15.1.1 و 13.7.2 على Ubuntu 24.04.2 LTS أسماء المستخدمين في Umbraco هي على حد فهمي عناوين بريد إلكتروني. تقبل هذه الأداة قائمة من "أسماء المستخدمين" -f وعنوان URL -u...
CVE-2020-24033
أحدث إصدار من fs.com S3900 24T4S 1.7.1 وجميع الإصدارات السابقة، ثغرة CSRF في الإدارة الخلفية النموذج لا يمتلك آلية مصادقة أو مصادقة رمزية token، وبالتالي توجد ثغرة تزوير الطلبات عبر المواقع Cross-Site Request Forgery إضافة حساب مستخدم لإضافة مستخدم بصلاحية كاملة. جميع النماذج على S3900 24T4S معرض...
CVE-2019-8449
CVE-2019-8449 Preuve de concept d'exploitation pour CVE-2019-8449 Jira 8.4.0 Énumération d'utilisateurs Détail: https://www.cvedetails.com/cve/CVE-2019-8449/ Utilisation $ go run CVE-2019-8449.go -f USERFILE.txt -p 8080 -u example.com...
CVE-2022-0847_dirty-pipe
CVE-2022-0847 / Dirty Pipe استغلال PoC مُعدَّل لثغرة Dirty Pipe CVE-2022-0847 يختطف ثنائي SUID لتشغيل قشرة بصلاحيات الجذر. وكذلك يحاول استعادة الثنائي المتضرر النتيجة CVSS : 7.8 HIGH تم اكتشاف خطأ في الطريقة التي يفتقر بها عضو "flags" في بنية مخزن الأنابيب الجديد إلى تهيئة صحيحة في دالتي...
ensimag-secu3a-cve-2024-22416
CVE-2024-22416 المرجع: GHSA-pgpj-v85q-h5fm يحتوي هذا المستودع على إعداد docker compose يُجهّز كلاً من خادم pyLoad وخادم مهاجم يوفّر csrf.html فقط. لتجربة الثغرة بنفسك، فقط شغّل docker composer up تحتاج إلى تثبيت docker composer بالإضافة إلى docker. ثم ابدأ بالانتقال إلى localhost:8000، وهي صفحة...
CVE-2025-5548
⚡ CVE-2025-5548 : Recherche et exploitation de vulnérabilité Ce dépôt fournit une analyse technique et une démonstration de concept pour CVE-2025-5548. Cette recherche couvre le cycle de vie complet de la vulnérabilité, de l'inspection initiale du binaire à l'exploitation réussie. ⚠️ Avertissement...
CVE-2023-31703
CVE-2023-31703 — XSS réfléchi dans eScan Management Console Vue d'ensemble Identifiant CVE : CVE-2023-31703 Type de vulnérabilité : Cross-Site Scripting XSS réfléchi Produit concerné : Microworld Technologies eScan Management Console Version concernée : 14.0.1400.2281 Sévérité : Moyenne Découvert...