CVE-2019-16097

CVE-2019-16097 Harbor Unauthorized Admin Creation Vulnerability Principle docker and poc based on pocsuite framework...

CVE-2021-21809

CVE-2021-21809 POC CVE details: A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities. In the belo...

CVE-2022-45771-Pwndoc-LFI-to-RCE

Pwndoc local file inclusion to remote code execution of Node.js code on the server, discovered by @yuriisanin Features Custom Node.js code to execute server-side using --payload-file Cleanup after exploit Requirements An admin account on the PwnDoc instance Usage $...

CVE-2023-28121

CVE-2023-28121 WooCommerce Payments: Exploit de acceso de administrador no autorizado No publicaré este primero... eso es seguro.. El PoC ya está publicado. ¡Fue creado solo con fines educativos/de investigación! ¡Úsalo bajo tu propio riesgo!...

CVE-2022-32060

Snipe-IT Version v6.0.2 Vulnerability Explanation: An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file. Attack Vectors: We found a vulnerability file upload, when we upload malicious file...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - Actualización de opciones arbitrarias sin autenticar Descripción El plugin no tiene comprobaciones de autorización ni CSRF al actualizar opciones a través de un endpoint REST, y no garantiza que la opción a actualizar pertenezca al plugin. Como resultado,...

CVE-2020-11444

CVE-2020-11444 Nexus 3 Unauthorized Access Exploit Script For more exploit scripts, see: https://github.com/zhzyker/exphub Readme +-----------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + +...

exploit_cve-2021-29447

exploitcve-2021-29447 For educational purposes only. This exploit is supposed to be really convenient tool to get any file from server running wordpress 5.6.2 and php8. see https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5 All you need is base wp-admin access and ability to...

CVE-2019-1040

CVE-2019-1040 ¡Excelente artículo! Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin . Así que escribí CVE-2019-1040.py para que sea fácil de usar. También puedes revisar mi repositorio exchange2domain: https://github.com/ridter/exchange2domain, otra forma de usa...

CVE-2024-0204

CVE-2024-0204: Authentication Bypass in GoAnywhere MFT Script to create a new admin user in GoAnywhere MFT. Blog Post More details here: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Usage Password must be at least 8 characters long to meet GoAnywhere...

Fast-Google-Dorks-Scan

Escaneo Rápido de Google Dorks El proyecto OSINT, cuya idea principal es recopilar todas las combinaciones posibles de búsqueda de Google dorks y encontrar información sobre el sitio web específico: paneles de administración comunes, tipos de archivos extendidos y path traversal. Automatizado al...

EUVD-2026-92816

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...

CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates

CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates A critical RCE vulnerability in Windows TCP/IP stack CVE-2025-26686 leaves sensitive memory unlocked, allowing remote attackers to hijack systems. Exploitable over the network, it risks full compromise. Patch now By Mark Mallia Type: Remote Code...

CVE-2022-36433

CVE-2022-36433 Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading ...

PT-2026-106511

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...

CVE-2026-95153

A vulnerability exists in Bludit CMS 3.22.0 that allows a remote attacker to obtain sensitive information . The issue is accessible via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints. No specific root cause, exploit details, or remediation steps are provided in the available docum...

PT-2026-106719

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password resul...

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

EUVD-2026-93552

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin Account Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-8181 Plugin| Burst Statistics – Privacy-Friendly WordPress Analytics Affected Versions| 3.4.0 – 3.4.1.1 Patched Version| 3.4.2 CVSS Score| 9.8 Critica...