CVE-2016-2098

CVE-2016-2098 Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. Explanation: This issue comes from the usage of the render method on user-supplied data. The method render is usually used to render a page from a template, but render method also allows...

dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

retryabledns

Retryable dns resolver Based on miekg/dns and freely inspired by bogdanovich/dnsresolver. Features Supports both system default DNS resolvers and user-provided ones Retries DNS requests in case of I/O errors, timeouts, or network failures Allows arbitrary query types Resolution with random...

OpenCATS - Open Redirect

OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations. id: CVE-2023-27292 info: name:...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Gradio - Open Redirect

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

CVE-2025-65264

CVE-2025-65264 Descripción En CPU‑Z 2.17 y anteriores y otros productos que usan el controlador CPU-Z con versión 1.0.6.1 y anteriores, el controlador ej. cpuz161.sys desreferenció un valor desde una dirección proporcionada por el usuario y lo escribió en el búfer del sistema suministrado por la...

CVE-2016-2098-my-first-exploit

CVE-2016-2098-my-first-exploit This exploit is remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. It's written in python3, and remember to install the requests library. here is the command. root@kitploit: pip3 install requests...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

EUVD-2026-70822

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue...

CVE-2026-64195

CVE-2026-64195 is an out-of-bounds write vulnerability in DASYLab (by MEAS X), caused by insufficient validation of user-supplied data when parsing a .DSB file . Successful exploitation requires a user to open a specially crafted .DSB file. All versions before 2026.0.0 are affected; updating to 2...

CVE-2026-81766

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

Astra Linux – Vulnerability in python-setuptools

A vulnerability exists in the packageindex module of pypa/setuptools versions up to 69.1.1, allowing for remote code execution through its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are vulnerable t...

PT-2026-72896

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW PRIMITIVES header size before division vmw cmd draw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

CVE-2026-16879

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input...

EUVD-2026-57542

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

PT-2026-71164

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input...

ImageMagick < 6.9.13-51 / 7.x < 7.1.2-26 Heap Buffer Over-write (CVE-2026-62343)

The remote host has a version of ImageMagick installed that is prior to 6.9.13-51 or 7.x prior to 7.1.2-26. It is, therefore, affected by a heap buffer over-write vulnerability: - An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied...

CVE-2026-17598

CVE-2026-17598 affects Sonatype Nexus Repository 3. The issue is improper input validation in scheduled task configuration: internal configuration keys from user-supplied task properties are not properly filtered when creating/updating a scheduled task via the admin UI. A user with permission to ...

EUVD-2026-54517

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...