CVE-2026-102363

The mall4j framework (versions through 4.0 ) is vulnerable to an unauthenticated shipment tracking disclosure. The flaw exists in the DeliveryController checkDelivery endpoint, where a missing authentication check allows attackers to retrieve shipment tracking information by providing an order nu...

CVE-2026-102363 mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102361 mall4j through 4.0 Missing Authentication in Password Update Endpoint

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling...

CVE-2026-102361 mall4j through 4.0 Missing Authentication in Password Update Endpoint

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102362

The mall4j framework, version 4.0 and below , contains a vulnerability where the DELETE /prodComm endpoint in ProdCommController lacks proper authentication controls. This flaw allows unauthenticated attackers to delete arbitrary product reviews by providing a prodCommId parameter without undergo...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102361

The mall4j software, version through 4.0 , is vulnerable to a missing authentication flaw in the PUT /user/updatePwd endpoint. This vulnerability allows unauthenticated attackers to reset the password of any storefront account by providing a target username in the request body without verificatio...

CVE-2025-59528

Version francaise CVE-2025-59528 Proof of Concept Minimal PoC focused on technical validation of the vulnerability in an authorized environment. Prerequisites You must have a user account on the target Flowise dashboard. You must have a valid API key linked to that account. You must start a...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

CVE-2024-7124

CVE-2024-7124 Reflected XSS in DInGO dLibra from 6.0 = 6.3.20 Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting XSS. An attacker might trick somebody in...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...

livewire-honeypot

Livewire Honeypot A high-interaction honeypot that masquerades as a vulnerable Laravel/Livewire application. It captures exploit attempts targeting known Livewire CVEs, stores uploaded malicious files webshells and remote code execution RCE payloads with SHA-256 deduplication, and optionally...

LinusWare-Source-Code-Internal

Linusware 1.2 — Source Code & Engine Architecture Reconstructed, Reverse-Engineered & Documented by tekkenbugatti Target Platform: Linux x8664 / Luau / Roblox Runtime Engine Overview Linusware 1.2 is a native Linux x8664 runtime extension and execution engine for Roblox / Luau. This repository...

chamilo-lms-unauthenticated-big-upload-rce-poc

Chamilo LMS Unauthenticated Big Upload File RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and instal...

CVE-2019-2215

CVE-2019-2215 CVE-2019-2215 — Android Binder Use-After-Free Privilege Escalation Description Exploit for vulnerability CVE-2019-2215 — use-after-free in the Android kernel binder driver. Allows privilege escalation to root on vulnerable devices. Vulnerability CVE-2019-2215 — use-after-free in...

CVE-2026-48203

CVE-2026-48203 — camel-solr SolrParam. / SolrField. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel...

CVE-2024-6678

CVE-2024-6678 - GitLab: Pipeline Schedule Arbitrary User Trigger PoC for CVE-2024-6678 Vulnerability Description GitLab allows users to manually trigger CI/CD pipeline schedules Pipeline Schedules via the "Play" button. The vulnerability lies in the fact that the "play" function allows any user...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo...