28 POSTS · CVE
DATECATTITLETARGETCVSS
2026· 1
17-01CVEGHSA-38cw-85xc-xr9x Veramo Data Store ORM SQL InjectionVeramo6.82024· 7
03-02CVECVE-2023-41283 - QTS 5.1.x, QuTS hero h5.1.x, QuTScloud 5.x OS Command InjectionQNAP7.203-02CVECVE-2023-41281 - QTS 5.1.x, QuTS hero h5.1.x, QuTScloud 5.x OS Command InjectionQNAP7.203-02CVECVE-2023-39303 - QTS 5.1.x, QuTS hero h5.1.x, QuTScloud 5.x Improper AuthenticationQNAP5.303-02CVECVE-2023-39297 - QTS 5.1.x, 4.5.x; QuTS hero h5.1.x, h4.5.x; QuTScloud 5.x OS Command InjectionQNAP8.803-02CVECVE-2023-39302 - QTS 5.1.x, QuTS hero h5.1.x, QuTScloud 5.x OS Command InjectionQNAP7.203-02CVECVE-2023-41282 - QTS 5.1.x, QuTS hero h5.1.x, QuTScloud 5.x OS Command InjectionQNAP7.206-01CVECVE-2023-39294 - QTS 5.1.x, QuTS hero h5.1.x OS Command InjectionQNAP7.22023· 6
10-11CVECVE-2023-41285 - QNAP Qumagie < 2.1.4 SQL InjectionQNAP8.810-11CVECVE-2023-41284 - QNAP Qumagie < 2.1.4 SQL InjectionQNAP8.810-11CVECVE-2023-39295 - QNAP Qumagie < 2.1.3 OS command injectionQNAP8.827-04CVECVE-2023-2338 - Pimcore SQL Injection in AssetControllerPimcore8.827-04CVECVE-2023-2336 - Pimcore Path Traversal in Asset "import from server" optionPimcore6.513-04CVECVE-2023-29506 - XWIKI RXSS with authenticate endpointsXWIKI6.12022· 5
13-12CVECVE-2022-46391 - Awstats hostinfo reflected XSSAwstats6.122-11CVECVE-2022-45152 - Moodle Blind SSRF in LTI provider libraryMoodle4.513-08CVECVE-2022-3967 - VestaCP func/main.sh argument injectionVestaCP7.818-07CVECVE-2022-35651 - Moodle Stored XSS and blind SSRF possible via SCORM trackMoodle6.115-02CVECVE-2022-24977 - ImpressCMS path traversal to pre-auth RCEImpressCMS9.82021· 1
07-12CVECVE-2020-36474 - Vanilla SSRFVanilla9.8CONTACT
rekter0
PROFESSIONAL SLOPPER
Application security research. vulnerability disclosure, and the occasional pre-auth RCE chain.
28CVE7EXPLOIT14POST