CVE-2026-82544 wger-project wger Password Reset gym.py reset_user_password cross-site request forgery

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function resetuserpassword of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This...

CVE-2026-82544 wger-project wger Password Reset gym.py reset_user_password cross-site request forgery

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function resetuserpassword of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2021-44228-Scanner

log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch. It also detects CVE-2021-45046 log4j 2.15.0, CVE-2021-45105 log4j 2.16.0, CVE-2021-44832 log4j 2.17.0, CVE-2021-4104, CVE-2019-1757...

CVE-2023-3460

🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit This is a proof-of-concept PoC exploit for CVE-2023-3460, a critical vulnerability in the WordPress plugin Ultimate Member. It allows unauthenticated users to escalate their privileges to Administrator by crafting a maliciou...

CVE-2000-0649

CVE-2000-0649 CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server. Official details are here: Rapid7 CVE NIST This particular vulnerability became of interest to me because it seems to affect current NGINX and some Apache setups as well...

parallels-file-move-privesc

parallels-file-move-privesc This repository contains an exploit for CVE-2023-50226 / ZDI-CAN-21227, which can be used to escalate privileges to root using Parallels Desktop on versions before 18.3.2...

CVE-2013-3827

CVE-2013-3827 Quick PoC checker for common configurations that might be available via directory traversal due to CVE-2013-3827 Usage: 1. Modify the contents of traversal.py to match your needs 2. python3 traversal.py...

CVE-2017-18345-COM_JOOMANAGER-ARBITRARY-FILE-DOWNLOAD

COMJOOMANAGER 2.0 -ARBITRARY FILE DOWNLOAD Collecting databases in mass with plugin : COMJOOMANAGER, From CMS: Joomla, Project developed in python 2.x, more information, access the youtube video. CVE: 2017-18345 Risk : Security Risk High 0day.Today-ID: 29950 ExploitDB-id: 44252 0day db-id:...

CVE-2025-25461

📌 CVE-2025-25461 - Stored Cross-Site Scripting XSS in SeedDMS 6.0.29 📝 Description A Stored Cross-Site Scripting XSS vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - HTML Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A HTML injection vulnerability exists in the Online Event Booking and Reservation System version 2.3.0. An attacker can leverage this vulnerability...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 Palo Alto File Write Exploit This exploit search over Global Protect URLS instances & try to write-file using CVE-2024-3400 Use with Caution Made with educational Purpouses only Usage: root@kitploit: chmod +x gp-exploit.sh ./gp-exploit.sh filenametowrite urls.txt Shoda...

Apisix_Crack

ApisixCrack Overview Apisix series vulnerability detection and exploitation tool, including unauthorized access vulnerability CVE-2021-45232 and default secret key vulnerability CVE-2020-13945, supports batch detection and exploitation. Usage Batch detection: Write URLs line by line in a file,...

WPS-CVE-2022-24934

STAND WITH UKARINE Putin IS CRIMINAL! Warning THIS PROGRAM USE GENERIC WHICH IS INTRODUCED IN GO 1.18, UPGRADE YOUR COMPILER! CVE-2022-24934 Web Server for exploiting this vuln by utilizing wpsupdate.exe Fake WPS Update Server PoC Research Purpose Only. Download file Set the file you want to send...

CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento

CosmicSting: critical unauthenticated XXE vulnerability in Adobe Commerce and Magento CVE-2024-34102 CVE-2024-34102 is a severe security flaw arising from improper handling of nested deserialization in Adobe Commerce and Magento. This vulnerability permits attackers to exploit XML External Entiti...

CVE-2023-6063

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. root@kitploit: $ python sqlmap.py --dbms=mysql -u...

CVE-2024-11680_PoC_Exploit

CVE-2024-11680 PoC Exploit This repository contains a Proof of Concept PoC exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and older versions. The exploit targets an improper authentication flaw due Privilege Misconfiguration issues. Features Exploits improper auth to...

CVE-2024-3495-Poc

CVE-2024-3495-Poc CVE-2024-3495 Country State City Dropdown CF7 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 Apple...

cve-2020-0688

cve-2020-0688 Usage: root@kitploit: usage: cve-2020-0688.py -h -s SERVER -u USER -p PASSWORD -c CMD optional arguments: -h, --help show this help message and exit -s SERVER, --server SERVER ECP Server URL Example: http://ip/owa -u USER, --user USER login account Example: domain\user -p PASSWORD,...