Current: English
Just a wandering code sorceress traveling between Git commits and ramen shops
A security vulnerability in Open Journal Systems (OJS) could allow an authenticated Author to influence the filesystem path used when deleting a publication cover image. The issue can lead to arbitrary file deletion within the permissions available to the OJS process and could cause severe application disruption if sensitive application files are affected.
GitLab has released emergency security updates to address a critical GraphQL code injection vulnerability that could allow unauthenticated attackers to modify or delete public projects and user data
File upload functionality is one of the most consistently exploitable attack surfaces in web applications
Adobe has patched a critical command-injection vulnerability in Adobe Campaign Classic that carries the maximum CVSS score of 10.0 and can allow arbitrary code execution without authentication or user interaction
Winter CMS has addressed a high-severity stored cross-site scripting vulnerability affecting its backend branding functionality
The Vebto Platform research repository documents a multi-stage unauthenticated remote code execution chain affecting the shared foundation used by products such as BeLink, BeDesk, BeDrive, BeMusic, MTDB, and Architect. The chain combines a social-authentication bypass with unsafe file-storage contro...
The Acelle Mail research repository documents a multi-stage unauthenticated remote code execution chain affecting version 4.2.0-p97. The chain combines public account creation, subscription assignment, authentication bypass, unsafe Twig template processing, and a public campaign-preview route.