cve-2025-29927

CVE-2025-29927 CVE-2025-29927 Vulnerability All versions of Next.js from 11.1.4 through 13.5.6, 14.x before 14.2.25, and 15.x before 15.2.3 are affected by this vulnerability. The impact is particularly significant for applications that rely on middleware for implementing access controls, as...

exploit-CVE-2016-10034

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

NanoMQ-Memory-Leak-Research

CVE-2026-36590: Denial of Service in EMQ NanoMQ v0.24.9 This repository contains the public advisory and technical analysis for CVE-2026-36590, a denial-of-service vulnerability affecting EMQ NanoMQ v0.24.9. Review Note This repository is public to provide an accessible technical reference for CV...

CVE-2023-0157

CVE ID : CVE-2023-0157 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...

CVE-2025-4606

CVE-2025-4606- WordPress Sala Theme = 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover 🔥 Vulnerability Summary The WordPress theme Sala versions = 1.1.4 is vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attacke...

CVE-2026-90910

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2025-41088

CVE-2025-41088: Stored XSS in Xibo CMS I have discovered a Stored Cross-Site Scripting XSS vulnerability in Xibo CMS v4.1.2. This vulnerability allows an authenticated attacker to inject malicious scripts into the application due to improper validation of user-supplied input. The issue resides in...

EUVD-2026-104165

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910 Apache Answer: Reaction API authorization bypass for restricted content

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910 Apache Answer: Reaction API authorization bypass for restricted content

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910

The Apache Answer software, versions through 2.0.2 , is vulnerable to a missing authentication for critical function vulnerability in its reaction API . The API fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted content or perfo...

CVE-2024-52510

Nextcloud X-E2EE-SIGNATURE Bypass POC Summary During normal operation of Nextcloud's E2EEv2 protocol, clients cryptographically sign folder-metadata before uploading to the server. This ensures the metadata has not been tampered with when it is re-fetched for the purposes of file-sharing or synci...

PolinRider

PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...

opensshenum

Description: Opensshenum is an OpenSsh user enumerator permitting to verify an arbitrary list of user names against an OpenSsh server, to know those actually presents on that remote machine. This program exploits a bug corrected in July 2018 proven to be effective at least starting from OpenSSH...

swarmer

swarmer A tool for sneakily adding registry keys to HKCU without EDR/AV being able to see what's happening even if you don't have administrator access. How do I use this? NOTE: You will only get to do this ONCE, afterNTUSER.MAN is your new registry hive you CANNOT change it without being an admin...

DPAPISnoop

DPAPISnoop A C tool that extracts crackable DPAPI hashes from user MasterKeys and CREDHIST files. Targets both the MasterKey $DPAPImk$ and the full CREDHIST chain $credhist$, supporting local paths and remote SMB shares. What it extracts MasterKey hashes $DPAPImk$ MasterKey for each user can be...

mole

Mole Mole is a Binary Ninja plugin designed to identify interesting execution paths in binaries. It performs backward slicing on variables using Binary Ninja 's Medium Level Intermediate Language MLIL in Static Single Assignment SSA form, forming the basis for a static taint analysis. In Mole , a...

CVE-2024-42327

PoC and Exploit for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being calle...

NiCOFF

NiCOFF Basically, NiCOFF is a COFF and BOF file loader written in Nim. NiCOFF reads a BOF or COFF file, parses and executes it in the memory. Whole project is based on Yasser's and Kevin's COFF Loader projects. Both the loader and beacon functions in these projects were rewritten in Nim...