CVE-2019-5420-PoC

CVE-2019-5420-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Nice argparse stuff, not a bad PoC Usage usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY VALUE...

CVE-2023-22515-check

Disclaimer This script is for educational and testing purposes only. Use it responsibly and ensure you have permission to test the target Confluence instance. Unauthorized testing is illegal and unethical. Confluence CVE-2023-22515 Vulnerability Detection Script This script checks if a Confluence...

CVE-2026-92555 Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

CVE-2026-92555

The AKINSOFT WOLVOX Control Panel by AKIN Software Computer Import-Export Industry and Trade Co. Ltd. is vulnerable to an insertion of sensitive information into sent data (CWE-201). This flaw allows an attacker to pull data from system resources , potentially including database credentials . The...

EUVD-2026-94868

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

CVE-2026-107573 Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2026-107573 Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

CVE-2025-69581

CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the...

Security Bulletin: Multiple Vulnerabilities affects IBM Data Studio Client 4.2.3

Summary Security Fix of multiple Vulnerabilities of IBM Data Studio Client 4.2.3. The vulnerabilities have been addressed in 4.2.3 version. Hence, IBM strongly recommends upgrading to 4.2.3. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in...

cve-2025-55182

CVE-2025-55182 Python Exploit Python 3 script that can be used to demonstrate CVE-2025-55182. It exploits a server-side JavaScript injection vulnerability in Next.js/React applications, allowing remote code execution via malformed multipart form data. ⚠️ For educational and authorized testing...

react2shell-scanner

React2Shell Vulnerability Scanner A safe, non-invasive scanner for detecting React Server Components RSC and Next.js Remote Code Execution vulnerabilities CVE-2025-55182 & CVE-2025-66478. Overview This scanner helps organizations identify whether their web services are vulnerable to the React2She...

RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis

1. C2 Connection – IP 198.46.86.63 Network analysis reveals that RedLine Stealer establishes a connection to the remote IP address 198.46.86.63. This IP is likely the malware's Command & Control C2 server, used for data exfiltration and command delivery. Key Observations: IP Address: 198.46.86.63...

CVE-2024-58290-Xhibiter-SQLi

CVE-2024-58290-Xhibiter-SQLi Proof of Concept PoC for SQL Injection in Xhibiter NFT Marketplace 1.10.2 Collections Endpoint. Discovered by Sohel Yousef. CVE-2024-58290: Xhibiter NFT Marketplace SQL Injection Exploit Title: Xhibiter NFT Marketplace 1.10.2 - SQL Injection Unauthenticated Date:...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-12260

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to access data sources they are not authorized to view. The /unauth-datasource and /authed-datasource endpoints fail to enforce proper access controls, potentially leaking sensitive conne...

CVE-2026-71183 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

EUVD-2026-94808

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...