News

Exploits

• [webapps] Krayin CRM v2.2.x - Authenticated Remote Code Execution
• [webapps] Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure
• [webapps] Langflow 1.9.0 - RCE
• [webapps] Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
• [webapps] MCPJam Inspector - Remote Code Execution
• [local] ProtonVPN v4.4.1 - Unquoted Service Path
• [webapps] Flowise 3.1.3 - arbitrary code execution
• [remote] Hydra - Stack Buffer Overflow
• [webapps] Discuz! X5.0 - Authentication Bypass
• [webapps] Tenable Nessus 10.12.1 - SQL Injection
• [webapps] WordPress Bricks Builder Theme - RCE
• [remote] iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter
• [webapps] Joomla Extension 4.1.4 - PHP Object injection
• [webapps] Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass
• [local] MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation
• [webapps] KeepInMind 0.8.4.2 - Stored XSS
• [webapps] KNX visualisering - Broken Access Control
• [local] Windows Defender (MsMpEng.exe) - Race Condition
• [webapps] WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)
• [webapps] OpenEMR 7.0.2 - Arbitrary File Read
• [webapps] WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection
• [webapps] Drupal Core 10.5.5 - Error-Based SQL Injection
• [webapps] WordPress OrderConvo 14 - Path Traversal
• [remote] Notepad++ 8.9.6 - Arbitrary Code Execution
• [webapps] YAMCS yamcs-core 5.12.7 - No Rate Limiting
• [webapps] YAMCS yamcs-core 5.12.7 - User Enumeration
• [webapps] YAMCS yamcs-core 5.12.7 - LDAP Injection
• [remote] Microsoft - NTLMv2 Hash Capture
• [webapps] MikroORM 7.0.13 - SQL Injection
• [webapps] Prodigy Commerce 3.3.0 - Local File Inclusion
• [webapps] Langflow 1.3.0 - Remote Code Execution
• [webapps] Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution
• [local] ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion
• [local] ZTE Routers - Unauthenticated Denial of Service
• [local] ZTE ZXHN H188A V6 - Authentication Bypass
• [local] ZTE H298A / H108N - Unauthenticated Credential Exposure
• [local] Linux Kernel - Local Privilege Escalation
• [webapps] MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
• [remote] Wing FTP Server 8.1.3 - Authenticated Remote Code Execution
• [webapps] CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
• [remote] strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow
• [dos] strongSwan 5.9.13 - DoS
• [local] Linux Kernel - Local Privilege Escalation
• [webapps] Casdoor 3.54.1 - Arbitrary File Write via Path Traversal
• [webapps] EspoCRM 9.3.3 - SSRF
• [webapps] scramble - Remote Code Execution

Last 20 Website Defacements - Zone-h

Advisories