310653 matches found
GO-2026-6671 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-6672 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-6673 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty Default in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
Open-Redirect-Finder
Open-Redirect-Finder Open Redirect Finder is an automation tool used to detect open redirect vulnerabilities on a URL. Features Batch Processing: Supports testing multiple URLs at once from an input file. Automatic Validation: Checks whether the entered URLs are vulnerable to open redirects...
CVE-2026-98548
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service DoS or memory corruption by sending specially crafted packets containing bundled error and data chunks. This issue...
MeterPwrShell
Inactive Tool - Reason : busy with something else . . . / \ / | \ \ / /| | | | | | \ \ / \ / / \ / \ \ | / / | \ \ | | / | | | | / / / Y \ /| | \ /| | / | \ / | | / | Y \ /| || |/ \ | /\ | \ | || // || / /|| /\ /| \ / / / / / / / MeterPwrShell2 Automated Tool That Generate A...
CVE-2023-46818
Metasploit-module Metasploit Module use exploit/linux/http/ispconfiglanguageedit set RHOSTS target.com set USERNAME admin set PASSWORD password123 set LHOST 127.0.0.1 set LPORT 4444 exploit An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language fi...
gimp:2.8 security update
An update is available for module.python2-pycairo, module.gimp, pygtk2, module.pygtk2, module.pygobject2, pygobject2, python2-pycairo, gimp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
PT-2026-118303
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...
PT-2026-118302
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation...
PT-2026-118307
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to...
PT-2026-118305
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...
PT-2026-120295
The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...
PT-2026-118297
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
PT-2026-118299
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty Default in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
PT-2026-118298
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
PT-2026-118301
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...
PT-2026-118589
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 import-export module versions prior to 3.7.0 Description Import routes invoke bigUploadMiddleware without an early authorize callback. This allows unauthenticated requests to perform upload initialization...
PT-2026-118492
Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...
PT-2026-118449
Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description Predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires o...