CVE-2019-10475

CVE-2019-10475 Quick POC for Jenkins CVE-2019-10475 / SECURITY-1490 reported on 2019-10-23. The issue is within the build-metrics plugin which generates some basic build metrics. It's commonly used with the Jenkins sidebar links plugin. This is a simple & generic reflected XSS vulnerability. The...

cve-2023-5044

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept Este es un programa rápido en Go para explotar la reciente CVE en el controlador Ingress Nginx. Los detalles sobre cómo hacer esto ya están disponibles a través del blog de Rory McCune en...

OpenSource-ERP-SQL-Injection

OpenSource-ERP-SQL-Injection OpenSource ERP application has SQL Injection vulnerability. CVE-2019-5893 https://vulners.com/cve/CVE-2019-5893 https://www.exploit-db.com/exploits/46118 PoC - Get DB name root@kitploit: POST /db/utils/query/data.xml HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.3;...

CVE-2026-44262

dedoc/scramble RCE CVE-2026-44262 PoC 📜 Descripción CVE-2026-44262 es una vulnerabilidad de Ejecución Remota de Código sin autenticación en dedoc/scramble, un generador de documentación de API de Laravel. NodeRulesEvaluator::doEvaluateExpression llama a extract$variables antes de . Cuando un...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2018-6643

CVE-2018-6643 CVE-2018-6643 Infoblox NetMRI 7.1.1 hxxp::/xxx.abc/api/docs/index.php?query=555"...

CVE-2022-23305_POC

CVE-2022-23305 Log4j JDBCAppender POC de inyección SQL Esta es una aplicación muy sencilla basada en Spring Boot que demuestra la vulnerabilidad CVE-2022-23305. Utiliza Apache Maven, Spring Boot, Spring MVC y la base de datos en memoria H2 para registrar una entrada simple, tomada como un parámet...

EUVD-2026-87328

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter Overview A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter e.g., utmcampaign and poison the cache. Subsequent visitors receive the...

CVE-2026-65694-PoC

CVE-2026-65694 — Microweber CMS Unauthenticated Arbitrary File Read Proof-of-concept for CVE-2026-65694 , an unauthenticated path-traversal → arbitrary file read in Microweber CMS. An unauthenticated attacker can read any file the web-server user can access — the Laravel .env APPKEY, DB...

CVE-2024-50340

CVE-2024-50340 POC Requirements The registerargcargv option must be enabled in the PHP configuration file php.ini. This setting loads command-line arguments and query params into $SERVER'argv'. https://www.php.net/manual/en/ini.core.phpini.register-argc-argv Explanation of Vulnerable Code This...

CVE-2025-30208-Vite

CVE-2025-30208 | Vite Script This tool is used to detect whether the target system has the CVE-2025-30208 vulnerability. This vulnerability allows an attacker to read sensitive files such as /etc/passwd or C:\windows\win.ini from the server via a specific path. The tool supports single URL...

EUVD-2026-84981

ReactPress has SQL injection via dynamic column names in TypeORM query builders...

CVE-2026-63445

A flaw was found in Perses, an open-source dashboard and visualization project. An authenticated attacker can exploit a vulnerability in list endpoints that use the file-system database. By manipulating the project query parameter with directory traversal characters, an attacker can read arbitrar...

EUVD-2026-84991

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2026-61685 ReactPress has SQL injection via dynamic column names in TypeORM query builders

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...

CVE-2026-63458

A flaw was found in Perses. An authenticated user with viewer access to one project can bypass authorization checks by manipulating the project query parameter on project-scoped list endpoints. This allows them to access and view resources, such as dashboards, datasources, and variables, belongin...

EUVD-2026-84859

ClipBucket v5 before 5.5.3-182 contains a reflected cross-site scripting vulnerability in the sortlink helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary...

CVE-2025-30208

CVE-2025-30208 Detection Tool Vulnerability Analysis Vite Arbitrary File Read Vulnerability Analysis and Reproduction CVE-2025-30208 Introduction This tool is used to detect whether a target system is vulnerable to CVE-2025-30208. This vulnerability allows an attacker to read sensitive files such...