OpenHunterAI

OpenHunterAI Your local AI red team. Attacker-style reasoning for web, API, and LLM application security. Quick start · Agent skill · Assessment model · Architecture · Docs · Star history OpenHunterAI brings scope, scan activity, findings, and remediation into one local workspace. Start without a...

jenkinsci__git-client-plugin_CVE-2019-10392_2-8-4

Git Client Plugin Introduction The git client plugin provides git application programming interfaces APIs for Jenkins plugins. It can fetch, checkout, branch, list, merge, and tag repositories. Refer to the API documentation for specific API details. The GitClient interface provides the primary...

cve-2026-63030-lab

CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in WordPress Core via REST API Batch Route Confusion + SQL Injection Overview wp2shell is a chain of two independently low-severity bugs in WordPress core that, when combined, allow an unauthenticated remote attacker to: 1. Reach an SQL injecti...

CVE-2026-104892 Plane: Plaintext logging of API token

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0...

CVE-2025-9074-PoC

Docker API RCE sin autenticación CVE-2025-9074 Una vulnerabilidad crítica CVE-2025-9074 en Docker Desktop permite que contenedores Linux que se ejecutan localmente se conecten a la API del motor Docker a través de la subred predeterminada 192.168.65.7:2375. El problema persiste independientemente...

CVE-2025-32778

CVE-2025-32778 - Exploit de Inyección de Comandos en Web-Check Descripción CVE-2025-32778 es una vulnerabilidad crítica de inyección de comandos en la herramienta OSINT Web-Check de Lissy93. Permite a atacantes no autenticados ejecutar comandos arbitrarios del sistema a través del parámetro url e...

CVE-2026-10520

CVE-2026-10520 Ivanti Sentry formerly MobileIron Sentry is an enterprise security gateway that proxies traffic between mobile devices and corporate backend resources: email, SharePoint, and internal web applications. It enforces Mobile Device Management MDM policies, terminates encrypted mobile...

cve-2014-0521

CVE-2014-0521 Adobe Reader vulnerability This JavaScript based Adobe Reader vulnerability affects all versions of Adobe Reader on all platforms prior to version 11.0.07 released on May 13, 2014. The bug was found by Gábor Molnár and was reported on March 10, 2014. Advisories: CVE-2014-0521 Adobe...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

wp2shell-Wordpress-TOWN

wp2shell by : lucifer0xf Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

CVE-2024-10924

CVE-2024-10924 Really Simple Security Free, Pro, and Pro Multisite 9.0.0 – 9.1.1.1 – Authentication Bypass Description The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user...

USN-8870-1 aodh, watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

USN-8870-1: OpenStack Aodh and Watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

CVE-2024-10924

POC for CVE-2024-10924 An error handling flaw in the REST API of the Really Simple Plugins WordPress plugin versions between 9.0.0 and 9.1.1.1 included allows an attacker, when Two-Factor Authentication is enabled, to bypass authentication and take control of an existing user or administrator...

jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17

Docker Commons API Plugin for Jenkins API plugin, which provides the common shared functionality for various Docker-related plugins. Summary API for managing Docker image and container fingerprints Credentials and location of Docker Registry Credentials and location of Docker Daemon aka Docker...

-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server

-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server This vulnerability allows an unauthenticated attacker to remotely execute arbitrary code on a vulnerable Confluence server. The vulnerability exists due to an improper validation of user-supplied input in the Confluence REST API. This allow...

CVE-2020-10148

Uso y descargo de responsabilidad Este script es una herramienta de detección por lotes para la vulnerabilidad de ejecución remota de código en la API de SolarWinds Orion CVE-2020-10148. Uso: Python CVE-2020-10148.py urls.txt Cada URL en urls.txt debe estar en una línea. Las direcciones vulnerabl...

CVE-2025-24893-XWiki-RCE

📜 Description A critical RCE vulnerability exists in XWiki that allows unauthenticated attackers to execute arbitrary system commands via vulnerable API endpoints. Exploitation can result in: Full server takeover Data theft or destruction Pivoting into internal networks 💥 Impact Complete compromi...

CVE-2021-21975

Productos afectados VMware vRealize Operations 8.3.0、8.2.0、8.1.1、8.1.0、7.5.0 VMware Cloud Foundation 4.x、3.x vRealize Suite Lifecycle Manager 8.x Descripción El 31 de marzo de 2021, VMware publicó oficialmente el aviso de riesgo de vmsa-2021-0004. Los números de vulnerabilidad son cve-2021-21975 ...

CVE-2022-24112_POC

POC Collected POCs CVE-2022-24112 To set up the Chunqiu Cloud Environment: CVE-2022-24112 target environment, two POCs were modified, slightly adapted from the POCs of M4xSec and twseptian for the Chunqiu Cloud Environment: Chunqiu Cloud Environment: CVE-2022-24112: Apache APISIX is a cloud-nativ...