Latest Exploit Articles
[webapps] Drupal Core 10.5.5 - Error-Based SQL Injection
Drupal Core 10.5.5 - Error-Based SQL Injection
[webapps] WordPress OrderConvo 14 - Path Traversal
WordPress OrderConvo 14 - Path Traversal
Lightweight Music Server (LMS) 3.76.0 (metadata) Stored XSS
LMS stores media file metadata tags (such as GENRE, ARTIST, and ALBUM) exactly as written in the file and later renders them in its web interface without HTML-encoding, resulting in stored cross-site scripting. An attacker who gets a file with a malicious tag into the victim's library has their payload saved during...
[remote] Notepad++ 8.9.6 - Arbitrary Code Execution
Notepad++ 8.9.6 - Arbitrary Code Execution
[webapps] YAMCS yamcs-core 5.12.7 - No Rate Limiting
YAMCS yamcs-core 5.12.7 - No Rate Limiting
[webapps] YAMCS yamcs-core 5.12.7 - User Enumeration
YAMCS yamcs-core 5.12.7 - User Enumeration
Pachno 1.0.6 FileCache Deserialization Remote Code Execution
The application uses unserialize() function on the contents of cache files stored under {PACHNO_PATH}/cache/ during the framework bootstrap sequence, before any authentication, routing, or controller logic is executed. Cache files are created with world-writable permissions (chmod 0666) and use deterministic,...
Pachno 1.0.6 (runSwitchUser()) Remote Vertical Privilege Escalation
The authorization check in the runSwitchUser() action evaluates the expression !canSaveConfiguration() && !hasCookie('original_username') and only forbids the request when both subexpressions are true. The presence of the original_username cookie is sufficient to satisfy the second condition, and that cookie is...
Pachno 1.0.6 Wiki TextParser XXE Vulnerability
Input passed via wiki table syntax ({|..., |-..., |...||...) and allowed inline tags (, , , etc.) in issue descriptions, comments, and wiki articles is concatenated into XML strings and parsed by simplexml_load_string() in the TextParser helper without setting LIBXML_NONET or otherwise restricting entity...
Pachno 1.0.6 Cross-Site Request Forgery
CSRF protection in the application is opt-in via the @CsrfProtected annotation and the csrf_enabled route flag, both of which are absent from a large set of state-changing endpoints including login, registration, logout, file upload, milestone editing, group/role/team/client/user administration, and Livelink commit...