CVE-2020-5248

CVE-2020-5248 Proof of Concept PoC for CVE-2020-5248. Summary GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the...

CVE-2026-19478-PoC

CVE-2026-19478 PoC Unauthenticated remote code-injection in GitLab's GraphQL layer that lets an attacker modify or delete public projects and user data with a single crafted query. No authentication, no user interaction, no special privileges. | ---|--- Severity| 9.4 Critical —...

EUVD-2026-92958

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-41563

The Sitemovr WordPress plugin, versions

CVE-2026-41563 WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-32576 WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2...

CVE-2025-53690

CVE-2025-53690 Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Code Injection.This issue affects Experience Manager XM: through 9.0; Experience Platform XP: through 9.0. How does this detection method work? This Nuclei...

CVE-2021-33558.

CVE : CVE-2021-33558. Exploit code of CVE-2021-33558 Summary In Boa/0.94.13 there is various misconfiguration.it expose various senstive information. Proof of Concept https://target.com/backup.html https://target.com/preview.html https://target.com/js/log.js https://target.com/log.html...

CVE-2024-3094

CVE-2024-3094 Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specifi...

CVE-2021-39165

CVE-2021-39165 Python3 POC for CVE-2021-39165 in CachetHQ Usage First of all, you should install the dependencies: pip3 install -r requirements.txt If you want to check whether the victim URL is vulnerable or not, you can execute: python3 exploit.py -u -c If you want to know the output of a MySQL...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

IncomCMS 2.0 - Arbitrary File Upload

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. id: CVE-2020-29597 info: name: IncomCMS 2.0 - Arbitrary File Upload author: princechaddha severity: critical description: |...

Jms Blog - SQL Injection

The module Jms Blog jmsblog from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes id: CVE-2023-27034 info: name: Jms Blog - SQL Injection author: MaStErChO severity: critical...

wordpress-jetpack-broken-access-control-exploit

wordpress-jetpack-broken-access-control-exploit This is a Python3 program that exploits Jetpack 13.9.1 broken access control vulnerability CVE-2024-9926. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool responsibly. I do not...

CVE-2025-70829

CVE-2025-70829: Information Exposure in Datart 中文文档 1. Vulnerability Overview CVE ID : CVE-2025-70829 Product : Datart Version : v1.0.0-rc.3 Vulnerability Type : Information Exposure An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive dat...

CVE-2015-7214

CVE-2015-7214 What is CVE-2015-7214? Please see the following link. Cross-site reading attack through data and view-source URIs Contents www/index.html SOP bypass PoC for Web local/index.html SOP bypass PoC for local Requirements Firefox version 42.0 or earlier The following is the download link ...

umberto

Umberto Umberto is a library designed for mutating generic structured data e.g., JSON, XML, X.509 and a command line application wrapping this functionality. It can apply a variety of mutations, synthesize totally new values, and apply existing mutators e.g. Radamsa to structure components. If...

CLEANSTART-2026-JM55948 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197)

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197...

CLEANSTART-2026-SC51338 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

EUVD-2026-92807

h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access...