1221 matches found
CVE-2021-41647
CVE-2021-41647 CVE-2021-41647 Online-Food-Ordering-Web-App 中的 SQL 注入漏洞 Online-Food-Ordering-Web-App 存在未经验证的错误型和时间型盲 SQL 注入攻击漏洞。 /login.php 页面上的 username 参数未对用户输入进行清理，攻击者可以使用简单的绕过技术绕过登录。 应用链接 Online-Food-Ordering-Web-App 受影响的组件与参数 URL: /login.php 参数: username POC 登录绕过 PAYLOAD 要绕过用户登录并获得完全的管理员访问权限，...
CVE-2021-26855-Scanner
CVE-2021-26855-Scanner CVE-2021-26855 的扫描器与 PoC PoC 致谢 GreyOrder。为了方便而重新上传，也因为微软至少下架过一次 : 批量扫描使用示例： shodan download --limit 12345 exchange "http.component:'outlook web+app'" gzip -d exchange.json.gz shodan parse exchange.json --fields=ipstr,port ips.txt python3 scan.py ips.txt...
CVE-2021-26855-SSRF-Exchange
CVE-2021-26855-SSRF-Exchange CVE-2021-26855 SSRF Exchange Server Shodan https://beta.shodan.io/search?query=http.component%3A%22outlook+web+app%22 https://beta.shodan.io/search?query=http.html%3A%22%2Fowa%22 Fofa https://fofa.so/result?q=title%3D%22Outlook+Web+App%22...
Google’s location data privacy failures draw a €403 million fine
The Irish Data Protection Commission DPC has fined Google €403 million $459 million for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020. During that time, Google collected users’ location data...
Astra Linux – Vulnerability in Chromium
In incorrect security user interfaces of web app installations in Google Chrome on Android before version 90.0.4430.212, an attacker who convinced a user to install a web application could inject scripts or HTML into a privileged page through a crafted HTML page...
Astra Linux – Vulnerability in Tomcat9
URL redirection to untrusted sites “open redirect” vulnerability in FORM authentication with Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.0.12, 9.0.0-M1 through 9.0.79, and 8.5.0 through 8.5.92. Older, end-of-life versions...
mobileAudit v3.2.0
Mobile Audit Security analysis for Android APKs, from upload to actionable findings. Mobile Audit is a Django application for static application security testing and malware inspection. It extracts APK metadata, detects risky implementation patterns, organizes findings by severity, and provides a...
zaproxy w2026-09-03
The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...
secbench-dvwa
DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...
Malicious code in @veertly/web-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 356a8a00db1082e33357c6fa0bd625070977f72964236e992e1be94dcd419764 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2026-53426
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...
CVE-2026-9190
Progress MarkLogic Server versions before 11.3.6 and 12.0.3 contain an HTTP request smuggling flaw in the HTTP App Server. A crafted request with both Content-Length and Transfer-Encoding headers can cause the reverse proxy and MarkLogic Server to misinterpret request boundaries, enabling an atta...
Chromium: CVE-2026-17819 Inappropriate implementation in WebAppInstalls
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
SUSE CVE-2026-20719
Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID:...
CVE-2026-16970 DFIR-IRIS Insufficient Logout Implementation
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...
CVE-2026-18362 DFIR-IRIS Missing Brute Force Protection in User Authentication
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...
CVE-2026-18362
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks...
CVE-2026-16971 DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...