CVE-2024-9933

CVE-2024-9933 WatchTowerHQ = 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check Description: The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.6. This is due to the 'watchtowerotatoken' default value is...

CVE-2024-9821

CVE-2024-9821 Bot for Telegram on WooCommerce = 1.2.4 - Authenticated Subscriber+ Telegram Bot Token Disclosure to Authentication Bypass Description The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on th...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Improper Access Controls on AJAX Calls Subscriber+ Description: Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin...

CVE-2019-5420

CVE-2019-5420 PoC A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code...

CVE-2022-47130

CVE-2022-47130 Academy LMS history.pushState'', '', '/'...

CVE-2022-47131

CVE-2022-47131 Academy LMS history.pushState'', '', '/'...

CVE-2023-34362

CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfer Technical Analysis A technical root cause analysis of the vulnerability can be found on the blog: Summary This POC abuses an SQL injection to obtain a sysadmin API access token and then uses that access to abuse a deserialization cal...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

EUVD-2026-95034

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623 Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw exists in the OIDC Dynamic Client Registration (DCR) component of Keycloak . A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

poc_cve-2026-42208

CVE-2026-42208 — LiteLLM Pre-Authentication SQL Injection A lab environment for reproducing and detecting CVE-2026-42208 , a critical pre-authentication SQL injection vulnerability in LiteLLM where unsanitized Bearer tokens reach a raw PostgreSQL query. Vulnerability Overview Field| Details ---|-...

eop24-26229

Firebeam CVE-2024-26229 plugin A small firebeam kaine's risc-v vm plugin to exploit the CVE-2024-26229 vulnerability that utilizes a vulnerable IOCTL in csc.sys. The vulnerability is used to get kernel R/W memory access to corrupt the KTHREAD-PreviousMode and then to leveraging DKOM to achieve LP...

Lab-for-cve-2018-15133

Summary: MExploiting CVE-2018-15133 Deserialization Vulnerability This exploit takes advantage of a deserialization vulnerability in the Laravel Framework through 5.5.40 and 5.6.x through 5.6.29. Description Remote code execution might occur as a result of an unserialize call on a potentially...

CVE-2020-10199_POC-EXP

Affected versions + + EXP: python3 cve-2020-10199poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version...

poc-proxycommand-vulnerable

RCE mediante /.ssh/config inseguro El uso de tokens como %h, %p en ProxyCommand es bastante popular para utilizar túneles y proxy de conexión mediante SSH. Configuración vulnerable host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Nota: en mi evaluación inicial tenía l...

CVE-2020-10199-10204

CVE-2020-10199-10204 http://1984-0day.com python3 poc.py -i 127.0.0.1 -p 8081 -c cookie -csrf csrf-token parse = argparse.ArgumentParser parse.addargument'-i', '--ip', help='ip' parse.addargument'-p', '--port', default='8081', help='port' parse.addargument'-c', '--cookie', help='HTTP cookie'...

CVE-2025-56311

CVE-2025-56311: Security Advisory – CSRF Vulnerability in FD602GW-DX-R410 Router Reboot Function Proof of Concept and Security Advisory for a Cross-Site Request Forgery CSRF vulnerability in the FD602GW-DX-R410 fiber router’s admin interface Firmware V2.2.14. The advisory outlines the impact,...

lucky13

LUCKY13 Exploit This repository contains a proof-of-concept POC exploit for the LUCKY13 vulnerability CVE-2013-0169, which is a timing attack against certain implementations of the CBC Cipher Block Chaining mode of operation in cryptographic systems. The exploit aims to decrypt a target token by...