247707 matches found
PT-2026-71678
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A stored cross-site scripting XSS issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during...
PT-2026-71511
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
CVE-2026-15141
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an...
CVE-2026-15141
CVE-2026-15141 affects the TL-WR820N web management interface. The issue stems from insufficient validation of the HTTP Referer header, allowing requests with an empty or missing Referer to be processed. This configuration- and information-exposure flaw enables an adjacent attacker with access to...
CVE-2026-15141 Referer Validation Bypass in TL-WR820N Web Management Interface
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an...
CVE-2026-15141 Referer Validation Bypass in TL-WR820N Web Management Interface
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an...
cyberange
大家好，我就是那个B站里面的用Kali学渗透。本仓库是网络安全渗透测试学习与训练靶场，包含Web漏洞靶场、渗透工具脚本、攻防手册等。内含：邻里圈靶场16+隐藏漏洞，含SQL注入/XSS/命令注入/文件上传/路径遍历等、零依赖渗透脚本、全工具链渗透脚本、PHP/CGI木马、反向Shell、密码破解工具、蜜罐防御系统、Metasploit精简版、Hacker OS一键构建脚本，以及DVWA攻防手册、Kali工具手册、recon-ng手册等学习文档。适合网络安全入门学习和CTF备赛参考。...
CVE-2026-54463 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation
A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...
next: Next.js: Server-Side Request Forgery vulnerability
A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF or Open Redirect attacks. When a rewrites or redirects rule constructs an external destination hostname using attacker-controlled...
CVE-2026-16694
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
K000162893: Spring Web Services vulnerability CVE-2026-40995
Security Advisory Description X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts...
CVE-2026-16694
IBM i CVE-2026-16694 (stored XSS in the Web UI) affects IBM i 7.3–7.6. An authenticated user can inject JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. IBM and NVD entries share a base CVSS v3.1 score of 6.4 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N...
CVE-2026-16694 IBM i is Affected By Stored Cross-site Scripting for i
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
EUVD-2026-57354
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2026-16694
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2026-65939
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...
CVE-2026-65940
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...