📄 OpenCATS 0.9.7.4 Time-Based Blind SQL Injection

This Python script targets a remote SQL injection vulnerability in OpenCATS version 0.9.7.4. ================================================================================================================================== | Title : OpenCATS 0.9.7.4 Time-Based Blind SQL Injection Exploit Data...

📄 OpenBMC bmcweb Denial of Service / Authentication Bypass

This Metasploit module exploits authentication bypass and denial of service vulnerabilities in bmcweb, the OpenBMC HTTP/Redfish web server that runs on BMC firmware for enterprise servers Intel, IBM, HPE, NVIDIA, and various ODMs...

📄 Pachno 1.0.6 XML Injection / Code Execution / Shell Upload

Authenticated Python exploit tool targeting Pachno version 1.0.6 with claimed XXE, privilege escalation, CSRF payload generation, unrestricted PHP webshell upload, open redirect testing, and a placeholder deserialization / remote code execution chain...

📄 NTLM Relay to Self Attack Module for Active Directory Privilege Escalation

This is a Metasploit module designed for Windows/Active Directory environments that performs an advanced NTLM relay-to-self attack to escalate privileges on a compromised machine...

📄 OpenEMR 7.0.2 Authenticated Arbitrary File Read

This Metasploit auxiliary module targets an authenticated arbitrary file read vulnerability in the Fax/SMS module of OpenEMR version 7.0.2 and related builds. ================================================================================================================================== | Title...

📄 Vtiger CRM 8.3.0 / 8.4.0 Shell Upload

This repository contains a Python proof of concept for CVE-2026-23698, an authenticated remote code execution vulnerability affecting Vtiger CRM. The PoC implements two exploitation techniques: abusing the Module Manager to import a malicious module containing a PHP webshell, and on certain...

📄 OpenSourcePOS 3.4.1 Cross Site Request Forgery

OpenSourcePOS version 3.4.1 suffers from a cross site request forgery vulnerability. ================================================================================================================================== | Title : OpenSourcePOS 3.4.1 CSRF Vulnerability Leading to Unauthorized Admin...

📄 Oracle E-Business Suite 12.2.14 Remote Code Execution

This Metasploit module exploits CVE-2025-61882, a pre-authentication remote code execution vulnerability in Oracle E-Business Suite versions 12.2.3 through 12.2.14. ================================================================================================================================== |...

📄 Vtiger CRM 8.3.0 Shell Upload

This is a focused authenticated remote code execution proof of concept exploit for Vtiger CRM version 8.3.0. It logs into Vtiger, uploads a .phar PHP webshell through the Documents module, uses /storage/ directory listing to discover the randomized uploaded filename, then executes commands throug...

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Click here to jump to the Simplified Chinese version 点击跳转到简体中文版本 Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Vulnerability Type: Path Traversal CWE-22 / Arbitrary File Read - Affected Product:...

GHSA-4G5X-HCWM-82JW Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Click here to jump to the Simplified Chinese version 点击跳转到简体中文版本 Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Vulnerability Type: Path Traversal CWE-22 / Arbitrary File Read - Affected Product:...

Open WebUI allows limited stored XSS vila uploaded html file

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

GHSA-8GH5-QQH8-HQ3X Open WebUI allows limited stored XSS vila uploaded html file

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

PrologueThese vulnerabilities have been found and chained by DCODX-AI. Validation of the exploit chain has been confirmed manually. SummaryA persistent stored cross-site scripting XSS vulnerability exists in the customhotkeys functionality of the application. An authenticated attacker or one who...

PYSEC-2026-1502 Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

Prologue These vulnerabilities have been found and chained by DCODX-AI. Validation of the exploit chain has been confirmed manually. Summary A persistent stored cross-site scripting XSS vulnerability exists in the customhotkeys functionality of the application. An authenticated attacker or one wh...

Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

SummaryThe download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...

PYSEC-2026-1581 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Summary The download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...

vLLM Tool Schema allows DoS via Malformed pattern and type Fields

SummaryThe vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference...

PYSEC-2026-2023 vLLM Tool Schema allows DoS via Malformed pattern and type Fields

Summary The vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference...

SUSE CVE-2026-9697

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI socks5:// or socks://. The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servernam...