CVE-2025-14156

CVE-2025-14156 Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder' ⚠️ CVE-2025-14156 – Fox LMS WordPress Unauthenticated Privilege Escalation Exploit 🛡️ Vulnerability Overview Fox LMS – WordPress LMS Plugin v1.0.4.7 to v1.0.5.1 – Unauthenticated...

gha-lab-677752506e

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gitroomhq/postiz-app at commit...

EUVD-2026-97167

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

CVE-2026-108796

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the Biometric Data Endpoint component. Specifically, an unknown part of the /iclock/finger_data/ file allows for an authorization bypass when the emp_code argument is manipulated. This attack can be initiated remotely . No ...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

CVE-2026-4255

CVE-2026-4255 Thermalright TR-VISION HOME DLL Side-Loading Privilege Escalation Severity: HIGH CVSS 8.4 CWE: CWE-829 Inclusion of Functionality from Untrusted Control Sphere Published: 16/03/2026 CNA: Toreon Affected versions: Thermalright TR-VISION HOME ≤ 2.0.5 Windows 64-bit Discovered by: Ard3...

Snyk Scan

Bitbucket Pipelines Pipe: Snyk This pipe uses Snyk to find, fix and monitor known vulnerabilities in your app dependencies and docker image. YAML Definition Add the following snippet to the script section of your bitbucket-pipelines.yml file: - pipe: snyk/snyk-scan:1.0.2 variables: SNYKTOKEN: ""...

FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — Unauthenticated SQLi to Root RCE Severity: Critical Type: Unauthenticated SQL Injection → Remote Code Execution Affected Software: FreePBX endpoint module Tested On: FreePBX on CentOS 7, Apache 2.4, PHP 7.4, MariaDB 5.5 Overview An unauthenticated SQL injection...

CVE-2020-7598

CVE-2020-7598 - Prototype Pollution in minimist Disclaimer This project is created only for: learning, security research, and private local lab. Do not use against systems without permission. About CVE CVE-2020-7598 is a Prototype Pollution vulnerability in the npm package: minimist vulnerable...

cacti-cve-2023-39361

Cacti ™ Running Cacti from the develop Branch IMPORTANT When using source or by downloading the code directly from the repository, it is important to run the database upgrade script if you experience any errors referring to missing tables or columns in the database. Changes to the database are...

Elastix-2.2.0-CVE-2012-4869

Elastix 2.2.0 Local File Inclusion Exploit - CVE-2012-4869 Description This script exploits a Local File Inclusion LFI vulnerability in Elastix 2.2.0 , allowing remote code execution RCE by injecting commands via the callmepage.php endpoint. The exploit is based on CVE-2012-4869. Features Bypasse...

FlowName

FlowName Name quality shows the ratio of names exclusively preferred by an automated, uncalibrated Jev evaluation.Animated chart → · Exact counts, method and limitations → Try FlowName in your browser → — enter your JavaScript, API key and model; no installation required. CLI: npx --yes...

CVE-2026-23550

🧨 CVE-2026-23550 – Modular Connector Admin Bypass Unauthenticated WordPress Admin Login viaorigin=mo Parameter Modular Connector Plugin ≤ 2.5.1 📖 Description The Modular Connector plugin for WordPress versions ≤ 2.5.1 contains a critical authentication bypass vulnerability. An unauthenticated...

CVE-2026-63030-CVE-2026-60137

wp2shell Pre-Auth RCE PoC - CVE-2026-63030 + CVE-2026-60137 WordPress 6.9.0–6.9.4 / 7.0.0–7.0.1 For authorized penetration testing and security research only. Running this against systems without written authorization is illegal. The authors accept no liability for misuse. Overview wp2shell is a...

CVE-2026-63030

LANGZ — wp2shell Exploit Tool Author: LANGZ CVE: CVE-2026-63030 Chained with CVE-2026-60137 Severity: Critical CVSS 9.8 Type: Pre-Authentication Remote Code Execution RCE ⚠️ Disclaimer This tool is provided strictly for educational purposes and authorized security testing only. By using this tool,...

badBANANA-threat-observatory

badBANANA // THREAT OBSERVATORY Inspect exploited vulnerabilities and threat indicators, check their source evidence, and review retained changes. Open the live Observatory · Try the KEV walkthrough · Source coverage · Run it yourself The Observatory brings CISA KEV, ThreatFox, URLhaus, and...

Kestra-cve-2026-53576

Unauthenticated RCE in Kestra via a Trailing-Path Auth Bypass CVE-2026-53576 Contents Executive Summary 1. Summary 2. Affected / Fixed Versions 3. Test Environment & Pre-Flight Check 4. Root Cause 5. Attack Simulation 6. Detection Engineering 7. ATT&CK Mapping 8. Remediation & Hardening 9...

CVE-2026-20079-checker

CVE-2026-20079 Cisco FMC Read-Only Checker A small, deliberately limited validation utility for CVE-2026-20079 , the Cisco Secure Firewall Management Center FMC authentication-bypass vulnerability. This repository is a checker, not an exploit. It does not contain the session-upgrade, file-write,...

CVE-2020-13935

Exploit for WebSocket Vulnerability in Apache Tomcat CVE-2020-13935 In the corresponding blog post the analysis and exploitation of the vulnerability is explained in detail. Usage Clone the repository, then build the tcdos binary. Run the program as follows to test whether a particular WebSocket...