210418 matches found
CVE-2025-8723
โก๏ธ Cloudflare Image Resizing Description: The plugin's REST API endpoint fails to authenticate users and improperly sanitizes input in the hookrestpredispatch method. This flaw enables attackers to inject and execute arbitrary PHP code by crafting malicious requests โ with no login required. ๐ ...
CVE-2024-53691
CVE-2024-53691 https://www.qnap.com/en/security-advisory/qsa-24-28 https://vulners.com/cve/CVE-2024-53691 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.7 "If exploited, the link following vulnerability could allow remote attackers who have gained user access to traverse the fi...
liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934
Authenticated Stored XSS in LifeRay 7.2.1 GA2 via MyAccountPortlet executed by Search Results In LifeRay version 7.1.0 through 7.2.1 GA2 the First Name, Middle Name, and Last Name fields for user accounts are all vulnerable to a Stored XSS issue. Any user can modify these fields with a particular...
CVE-2026-109201
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP...
Log4Shell-demo
Log4Shell in action This project aims to demonstrate how the Log4Shell / CVE-2021-44228 vulnerability works. Requirements You only need to have Docker installed. Ideally you have two different virtual machines. One for the vulnerable server and one for the malicious server that will host the...
FreePBX-Vulns-December-25
FreePBX Vulnerabilities - December 2025 This repository contains Nuclei templates for detecting three critical vulnerabilities in FreePBX: CVE-2025-61675 : Authenticated SQL Injection CVSS 8.6 - Affects endpoint module CVE-2025-61678 : Authenticated Arbitrary File Upload CVSS 8.6 - Affects endpoi...
CVE-2025-31324_PoC
CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...
CVE-2026-37065
CVE-2026-37065 Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion. To exploit the vulnerability, an authenticated attacker with the role of superadmin can send a specially crafted POST request to the affected endpoint using the url parameter remove to control the file to be...
EPScalate
EPScalate An elevation of privilege vulnerability in QuickHeal's Seqrite Enterprise Endpoint Security Solution EPS. The vulnerability has been assigned a CVE ID of CVE-2023-31497. https://user-images.githubusercontent.com/39941993/230790056-87157751-b96c-49a6-81df-bf3126acfbd6.mp4 Vendor and...
Next.js-Exploit-Tool
Next.js-Exploit-Tool Next.js-Exploit-Tool ๅพๅฝขๅ็ปผๅๅฉ็จๅทฅๅ ทใ ็ฎไป ไธๆฌพ้ๅฏน CVE-2025-55182 ็็ฌ็ซๅฎๅ จ่ฏไผฐๅทฅๅ ท๏ผๅบไบ Go ๅผๅ๏ผๆไพๅพๅฝขๅ็้ข๏ผGUI๏ผ๏ผ็จไบๅฟซ้ๅฎๆๆผๆดๆฃๆตไธ้ช่ฏใ ๆดๆฐๆฅๅฟ v1.3.0 ๆฐๅข Godzilla ๅฅๆฏๆ ๅ ๅญ้ฉฌๆฏๆ ๅฎ็ฐไบๅบไบ Node.js ็ Godzilla ๅ ๅญ้ฉฌๆณจๅ ฅๅ่ฝ๏ผๆฌ Payload ้้ ๅๅ่พฐๅธๅ ็้กน็ฎGodzillaNodeJsPayload ไฝฟ็จใ ่ด่ฐข Credits ๏ผ็นๅซๆ่ฐข ๅ่พฐๅธๅ ๅผๆบ็ GodzillaNodeJsPayload ้กน็ฎใ ๆฐๅข็ฝ็ปไปฃ็ๆฏๆ...
CVE-2018-10517
CVE-2018-12613 Authenticated remote command execution by uploading a fake module, dropping PHP files on remote web server. Software Affected 1. CMS Made Simple 2.2.7; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1. CMS Made Simple URL endpoint; 2. Cookie...
CVE-2026-63223-POC
CVE-2026-63223 PoC โ CodeIgniter 4 File Upload RCE CVSS 9.8 Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Unrestricted Upload of File with Dangerous Type Fixed : CodeIgniter 4 v4.7.4 Advisory : GHSA-mmj4-63m4-r6h5 Vulnerability Summary CodeIgniter 4's isimage and mimein file upload...
CVE-2026-60137-WordPress-Core-SQL-Injection-PoC
CVE-2026-60137 โ WordPress Core SQL Injection PoC Non-destructive proof-of-concept and verification harness for CVE-2026-60137 , a blind SQL injection in WordPress core WPQuery::authornotin, reachable via the REST API's authorexclude parameter. Root Cause WPQuery::getposts builds SQL by...
WP2Shell
WP2Shell - CVE-2026-63030 / CVE-2026-60137 WordPress REST API Batch SQL Injection to RCE Full discovery and exploitation tool for WordPress REST API Batch endpoint vulnerability. This tool exploits a critical SQL injection vulnerability in the WordPress REST API /wp-json/batch/v1 endpoint, allowi...
CVE-2020-13935
Exploit for WebSocket Vulnerability in Apache Tomcat CVE-2020-13935 In the corresponding blog post the analysis and exploitation of the vulnerability is explained in detail. Usage Clone the repository, then build the tcdos binary. Run the program as follows to test whether a particular WebSocket...
CVE-2025-3102
CVE-2025-3102 ๐ ๏ธ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version โค v1.0.78. If successful, the script will automatically create a WordPress admin account. โ๏ธ Features Detection...
CVE-2024-1303---Badgermeter-moni-tool-Path-Traversal
CVE-2024-1303 --- Badgermeter moni tool - Path-Traversal https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1303: 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CWE-22. Software link : https://www.s-can.at/en/product/monitool/...
WordPress-CVE-2026-63030-Analysis
๐ก๏ธ CVE-2026-63030: Technical Analysis & Audit Comprehensive defensive teardown, threat analysis, and non-destructive verification guidelines. Summary โข Matrix โข Technical Deep Dive โข Verification โข Remediation ๐ Executive Summary !IMPORTANT Defensive Purpose Only: This repository provides purely...
CVE-2024-36104-PoC
CVE-2024-36104-PoC Proof-of-concept for CVE-2024-36104, an unauthenticated remote code execution vulnerability in Apache OFBiz before 18.12.14. OFBiz's ControlServlet resolves an unauthenticated view forgotPassword before canonicalizing the request path. Appending /%2e/%2e/ collapses back onto...
CVE-2026-42588
CVE-2026-42588 - Apache ActiveMQ Jolokia Remote Code Execution Exploit Severity : ๐ด High CVSS 4.0: 8.1 Vulnerability Type : CWE-94 โ Code Injection Affected Versions : Apache ActiveMQ Prerequisites : Requires Web Console authentication credentials default admin:admin ๐ Table of Contents...