CVE-2026-71483

The Horilla HR and CRM software (prior to version 1.6.0 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the lack of HTML neutralization when the search parameter at /employee/employee-filter-view is reflected by jQuery's .html() function in employee/templates/emp...

CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2026-88421

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

pe_tree

PE Tree PE Tree 是一个 Python 模块，用于使用 pefile 和 PyQt5 以树状视图查看可移植可执行文件 PE 文件。 它还可以与 IDA Pro、Ghidra、Volatility、Rekall 和 minidump 一起使用，以查看和转储内存中的 PE 文件，并执行导入表重建。 目录 1. 功能 2. 应用程序 要求 功能 安装 Windows Mac/Linux 面向开发者 用法 暗色模式 3. IDAPython 要求 功能 安装 使用 setuptools 手动安装 面向开发者 用法 示例 转储内存中的 PE 文件 4. Rekall 要求 功能 安装...

CVE-2021-21978

CVE-2021-21978 CVE-2021-21978 RCE exp 影响版本 VMware View Planner Harness 4.X 与 CVE-2021-21978 类似，该漏洞可以在未授权访问的情况下，上传任意文件，并通过修改自带 py 脚本实现远程代码执行。 值得注意的是，执行命令是在 docker 容器中，并不是直接在系统中执行。 用法： go run CVE-2021-21978.go -h -c...

CVE-2026-88421

APSL puput versions v1.2.1 through v2.2.0 are vulnerable to an incorrect access control flaw in the BlogPage.get_entries() component. This vulnerability allows unauthenticated attackers to view restricted blog entries through multiple access points, including the blog index, tag, category, author...

EUVD-2026-87081

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

CVE-2026-88421

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

CVE-2024-21413-Moniker-Link-Writeup

CVE-2024-21413 – Análisis de la Vulnerabilidad Moniker Link Este repositorio contiene un análisis técnico de CVE-2024-21413 , una vulnerabilidad relacionada con el manejo de Moniker Links en Microsoft Outlook que permite a los atacantes eludir la Vista Protegida y filtrar credenciales NTLMv2...

CVE-2026-23498

CVE-2026-23498: Shopware tiene un control inadecuado de la generación de código en las vistas renderizadas con Twig Descripción general Campo| Detalles ---|--- CVE ID| CVE-2026-23498 Gravedad| ALTA Aviso| Ver aviso Descubierto por| Lukasz Rybak Productos afectados shopware/shopware versiones: =...

CVE-2026-21514_CVE-2026-21510

CVE-2026-21514 y CVE-2026-21510 Builders 1; CVE-2026-21514 Omisión de SBX u Omisión de Vista Protegida Reconstruir el paquete del documento con una ruta ofuscada hacia WindowsUpdateDiagnostic.xml dentro de word/rels/webSettings.xml.rels Pendiente Verificar otras configuraciones xml en la ruta...

CVE-2021-44228

CVE-2021-44228 Detección de backdoor para VMware View Horizon Esto incluye un canary con un envío opcional. Úsalo claramente bajo tu propio riesgo, etc. Está diseñado para ejecutarse en servidores de conexión de VMware Horizon en Windows. No analiza los dispositivos UAG son Photon Linux...

CVE-2026-94611

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

EUVD-2026-86277

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611

The open-source identity provider authentik is vulnerable to unauthorized credential exposure in versions prior to 2026.2.7 , 2026.5.7 , and 2026.8.2 . The authentik API serializers incorrectly return stored credentials when a user possesses view permission on an affected configuration, even if t...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2024-21413-Microsoft-Outlook-Moniker-Link-Vulnerability

CVE-2024-21413 – Vulnerabilidad de Moniker Link en Microsoft Outlook Resumen Este repositorio documenta mi análisis práctico de CVE-2024-21413 Moniker Link , una vulnerabilidad crítica de Microsoft Outlook que evade la Vista Protegida para filtrar credenciales NetNTLMv2 de Windows mediante...

tryhackme-monikerlink-writeup

TryHackMe: Moniker Link — Walkthrough del CVE-2024-21413 Un walkthrough completo de la sala "Moniker Link" de TryHackMe: explotar CVE-2024-21413, una vulnerabilidad de Microsoft Outlook de 2024, para robar el hash NTLMv2 de la víctima en el momento en que hace clic en un enlace de un correo de...