CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — Лабораторный стенд повышения привилегий с аутентификацией в WooCommerce Wholesale Prices Обзор Этот проект представляет собой локальный Docker-стенд для анализа и воспроизведения поведения CVE-2026-27541 в плагине WooCommerce Wholesale Prices / Wholesale Suite путём сравнения...

CVE-2026-42208-Lab

CVE-2026-42208 — PoC тайминговой SQL-инъекции LiteLLM до аутентификации Локальный Docker-лабораторный стенд и PoC с минимальным вредом для CVE-2026-42208 — уязвимости SQL-инъекции до аутентификации в пути проверки API-ключей LiteLLM Proxy. Этот репозиторий демонстрирует разницу между уязвимым...

CVE-2026-23744-Lab

CVE-2026-23744 – MCPJam Inspector Docker Lab Этот репозиторий — небольшая Docker-лаборатория для сравнения уязвимой и пропатченной сборок MCPJam Inspector для CVE-2026-23744. Он предназначен для обучения и создания публичного портфолио по безопасности: быстрая настройка, наглядные доказательства ...

vuln4japi

vuln4japi CVE-2021-44228log4shell을 시연하기 위한 취약한 Java 기반 REST API입니다. 동기 Log4Shell은 2021년 12월 초 인터넷을 강타했습니다. Apache Log4j 로깅 라이브러리의 제로데이 취약점으로, 원격 코드 실행RCE이 가능하여 전 세계 조직들이 공개된 Java 애플리케이션을 서둘러 수정/패치/완화하도록 만들었습니다. InfoSec 커뮤니티가 보안 팀에 지속적인 분석과 솔루션을 제공하기 위해 함께 모이는 동안, Log4j 커뮤니티는 이 취약점을 종식시키기 위한 패치 개발...

CVE-2026-25939-SCADA-FUXA-Unauthenticated-Remote-Arbitrary

👤 Автор Mohammed Idrees Banyamer Исследователь в области безопасности 📌 Обзор Этот репозиторий содержит эксплойт Proof-of-Concept PoC для CVE-2026-25939 — критической уязвимости обхода авторизации в FUXA программное обеспечение SCADA/ICS с открытым исходным кодом. Уязвимость позволяет...

CVE-2023-27163

CVE-2023-27163 Это PoC для CVE-2023-27163 — уязвимости SSRF, присутствующей в request-baskets вплоть до v1.2.1. Эта уязвимость позволяет злоумышленникам получать доступ к чувствительным сетевым ресурсам через /api/baskets/name. request-baskets содержит функциональность, позволяющую пользователю...

CVE-2021-36460

CVE-2021-36460 NVD CVE-2021-36460: https://nvd.nist.gov/vuln/detail/CVE-2021-36460 MITRE CVE-2021-36460: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-36460 CWE-836: Использование хеша пароля вместо пароля для аутентификации Приложение VeryFitPro Android: com.veryfit2hr.second, iOS =3.3.7...

-CVE-2026-26215-manga-image-translator-RCE

CVE-2026-26215 - manga-image-translator Pickle-десериализация RCE 👤 Автор Mohammed Idrees Banyamer Instagram: @banyamersecurity GitHub: @mbanyamer Proof-of-Concept эксплойт для CVE-2026-26215 - Неаутентифицированное удалённое выполнение кода через небезопасную Pickle-десериализацию в...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

EUVD-2026-91007

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059

Lektor versions 3.3.14 and 3.4.0b15 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the admin API blueprint . The root cause is a lack of CSRF tokens, Origin/Referer validation, CORS configuration, and Host allowlisting. This allows unauthenticated attackers to perform ...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-36956

CVE-2026-36956: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36956 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: Shenzhen Dibit Network Equipment Co., Ltd. Product: Dbit Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Descripti...

CVE-2026-20180

Cisco ISE RCE: Advanced Exploitation and Remediation Analysis 📋 Table of Contents 1. Executive Summary 2. Attack Surface Analysis 3. Exploitation Vectors 4. Advanced Evasion Techniques 5. Systemic Impact on Zero Trust Architectures 6. Remediation Strategy 7. Forensic Investigation 8. References 🎯...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ Classic RCE via Jolokia API TL;DR A remote code execution vulnerability in Apache ActiveMQ Classic that allows an attacker to execute arbitrary code by invoking the addNetworkConnectorString MBean operation through the Jolokia API /api/jolokia/. The attacker embed...

CVE-2026-1457

CVE-2026-1457: TP-Link VIGI C385 Authenticated Remote Code Execution Overview CVE-2026-1457 is an authenticated buffer overflow vulnerability in the web API of TP-Link VIGI C385 V1. This vulnerability allows authenticated attackers to perform remote code execution RCE. CVSS v4.0 Score: 8.5 High...

CVE-2026-35616-detector.py

CVE-2026-35616 - FortiClient EMS Vulnerability Detector Description This tool detects if a FortiClient EMS server is vulnerable to CVE-2026-35616 , a critical improper access control vulnerability affecting versions 7.4.5 through 7.4.6. CVSS Score: 9.1 Critical CWE: CWE-284 Improper Access Contro...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — Flowise NVIDIA NIM Authentication Bypass Checker and Exploit A proof-of-concept checker and exploit for CVE-2026-30824 , a critical authentication bypass vulnerability in Flowise that exposes NVIDIA NIM API endpoints without authentication. Vulnerability Overview CVE-2026-30824 i...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - Unauthenticated Privilege Escalation This is a Python script that exploits the CVE-2024-6624 vulnerability in the JSON API User = 3.9.3 plugin for WordPress. This tool allows unauthenticated attackers to register new users and escalate their privileges to...