CVE-2021-40375

CVE-2021-40375 - التحكم في الوصول المعطوب في OpenEyes 3.5.1 الوصف تم تحديد ثغرة في التحكم في الوصول في OpenEyes 3.5.1، الذي طوّرته مؤسسة Apperta. يمكن لمستخدم بصلاحيات منخفضة فتح ملف مريض في متصفحه والوصول إلى معلومات حساسة دون مستوى الصلاحية المطلوب. وعلى الرغم من أن التطبيق يُرجع رسالة...

CIFSwitch-Checker-CVE-2026-46243

CIFSwitch Checker - CVE-2026-46243 أداة فحص لنظام Linux تتيح تحديد التكوينات التي قد تكون عرضة لثغرة CIFSwitch CVE-2026-46243. لا تستغل الثغرة ولا تعدّل النظام. الهدف الرئيسي هو المساعدة في تحديد الأجهزة التي قد تكون متأثرة والتحقق من صحة التخفيفات. تقوم الأداة بإجراء فحوصات سلبية على: cifs-utils...

EUVD-2026-92070

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The...

CVE-2026-105099 Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

PoC-CVE-2018-15473

إثبات المفهوم - CVE-2018-15473 OpenSSH حتى الإصدار 7.7 معرض لثغرة تعداد المستخدمين بسبب عدم تأخير الخروج للمستخدم غير الصالح بعد تحليل الحزمة التي تحتوي على الطلب بالكامل، ويتعلق ذلك بـ auth2-gss.c و auth2-hostbased.c و auth2-pubkey.c. CVE: CVE-2018-15473 شرح من...

CVE-2019-1332

CVE-2019-1332: ثغرة برمجة نصية عبر المواقع المنعكسة في خدمات تقارير خادم SQL من Microsoft توجد ثغرة برمجة نصية عبر المواقع XSS عندما لا تقوم خدمات تقارير خادم SQL من Microsoft SSRS بتعقيم طلب ويب مُصمَّم خصيصًا بشكل صحيح لخادم SSRS متأثر. يمكن للمهاجم الذي نجح في استغلال الثغرة تشغيل نصوص برمجية ...

CVE-2020-11107

CVE-2020-11107 هذا هو شرح للثغرة CVE-2020-11107 التي اكتشفتها. تم اكتشاف مشكلة في XAMPP قبل الإصدار 7.2.29، والإصدارات 7.3.x قبل 7.3.16، والإصدارات 7.4.x قبل 7.4.4 على نظام Windows. يمكن لمستخدم غير مميز تغيير إعدادات ملف .exe في xampp-contol.ini لجميع المستخدمين بما فيهم المديرين لتمكين تنفيذ...

github-logs

GitHub Logs Extraire des informations OSINT à partir de 15 To de journaux d'événements GitHub Nous avons développé 3 workflows Trickest qui ont traité et enrichi l'ensemble du jeu de données des journaux d'événements GitHub, ce qui nous a fourni des informations précieuses. Désormais, toute la...

lab-cve-2016-15042

CVE-2016-15042 – WordPress Frontend File Manager et N‑Media Post Front‑end Form : téléversement de fichier non authentifié laboratoire de PoC Laboratoire dockerisé entièrement reproductible pour valider et démontrer la CVE-2016-15042 : Frontend File Manager nmedia-user-file-uploader v3.7 vulnérab...

EUVD-2026-92044

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

PT-2026-104634

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

PT-2026-104604

Name of the Vulnerable Software and Affected Versions Omega Solution CoinEx Crypto 2025 affected versions not specified Description A weakness in the Ticket Attachment Upload component allows for remote cross-site scripting XSS, a technique where malicious scripts are injected into trusted...

PT-2026-104631

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.15 ZITADEL versions 4.0.0 through 4.17.2 Description An issue exists where links are created between user accounts and external identity providers without verifying a primary factor or the caller's permission...

PT-2026-104611

Name of the Vulnerable Software and Affected Versions User Private Files WordPress plugin versions prior to 2.2.0 Description On multisite installations, the plugin fails to protect stored private files because the rewrite rule used to route file requests through the access check is not reached...

CVE-2026-105207: Missing Authentication for Critical Function

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

CVE-2026-105206: Incorrect Authorization

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105124: Improper Neutralization of Input During Web Page Generation

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-97332: Undefined Security Weakness

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private...