EUVD-2026-88981

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2018-10933

CVE-2018-10933 - libssh Authentication Bypass Proof-of-Concept implementation for CVE-2018-10933 , a critical authentication bypass vulnerability affecting the server-side implementation of libssh. Disclaimer This repository is provided solely for educational purposes, vulnerability research, and...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...

CVE-2025-24813

CVE-2025-24813 Exploit Toolkit This is an advanced and automated exploitation tool for CVE-2025-24813 , targeting Apache Tomcat servers vulnerable to insecure session deserialization. 🔍 Features Multi-target scanning from file or single URL --targets / --url Automatic gadget chain testing...

CVE-2025-5777

CVE-2025-5777 — Citrix NetScaler "CitrixBleed 2" Memory Disclosure Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. The sequel to the original CitrixBleed: an out-of-bounds read on NetScaler ADC/Gateway authentication endpoints that...

CVE-2023-45542

CVE-2023-45542 A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: q Exploit - Proof of Concept POC Reflect...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

CVE-2026-101269

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...

CVE-2021-24807

CVE-2021-24807 Support Board 3.3.4 Authenticated Stored XSS Authenticated Stored Cross Site Scripting XSS Vulnerability exists in Support Board Version 3.3.4 via Notes parameter. The impact of cross-site scripting vulnerabilities can vary from one web application to another. It ranges from sessio...

CVE-2026-101269

A flaw in the mechanism binding API-uploaded files to specific authentication methods allows the same session token to be used for all token-based API users. Although the protection mechanism is rendered useless , the documents state there is virtually no risk because the uploaded files are refer...

CVE-2026-101269 Incorrect session validation for API-uploaded files

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

CVE-2026-101269 Incorrect session validation for API-uploaded files

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

CVE-2026-101268

CVE-2026-101268 describes a customer session fixation vulnerability. An attacker can use a specially crafted link to trick a victim into logging into the attacker's customer account. If successful, the victim's order details may be stored within the attacker's account. This attack is specifically...

CVE-2026-101268 Customer session fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...

CVE-2026-101268 Customer session fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

CVE-2023-43325

mooSocial: XSS CVE-2023-43325 A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter:...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python exploit for the unauthenticated Lua-injection RCE in Wing FTP Server ≤ 7.4.3. Designed for shell delivery — one command from check to a working netcat callback. Written some time ago for wingData lab on HTB and open-sourced now. Use only...