ubercookie

🍪 ubercookie An educational demonstration of how websites persistently identify you — and why "clear your cookies" is no longer enough. ubercookie plants a single random id into 12 different browser storage vectors at once. Every time you visit, it reads them all, takes a consensus, and re-writes...

Sudo-Vulnerability-Exploit-CVE-2019-14287

Sudo-Vulnerability-Exploit-CVE-2019-14287 اكتُشف أن Sudo غير موثوق، وهي واحدة من أهم الأدوات المساعدة وأكثرها قوةً وانتشارًا، وتُثبَّت في أي نظام تشغيل قائم على Unix وLinux تقريبًا كأمر بسيط. ثغرة تجاوز سياسة أمنية زائفة تسمح بتنفيذ أوامر عشوائية على جهاز Linux مستهدف من قِبل مستخدم أو تطبيق خبيث...

EUVD-2026-95024

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-107637 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper authorization vulnerability in the note module delete action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remov...

CVE-2026-105828 Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

CVE-2020-10199_POC-EXP

الإصدارات المتأثرة + + EXP: python3 cve-2020-10199poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version +...

CVE-2024-51030

CVE-2024-51030 Description Une vulnérabilité d'injection SQL dans manageclient.php et viewcab.php de Sourcecodester Cab Management System 1.0 permet à des attaquants distants d'exécuter des commandes SQL arbitraires via le paramètre id, conduisant à un accès non autorisé et à une compromission...

CVE-2024-48427

CVE-2024-48427 الوصف ثغرة حقن SQL في Packers and Movers Management System من Sourcecodester الإصدار 1.0 تسمح للمستخدمين المصادق عليهم عن بُعد بتنفيذ أوامر SQL عشوائية عبر معامل id في /mpms/admin/?page=services/manageservice&id نوع الثغرة SQL Injection بائع المنتج Sourcecodester قاعدة كود المنتج...

CVE-2017-1000117

مستودع PoC لـ CVE-2017-1000117 لصالح VulApps مشتق من joernchen/CVE-2017-1000117 git clone --recursive https://github.com/VulApps/CVE-2017-1000117.git سيكتب مخرجات الأمر id إلى ملف vul في /var/www/html. انظر المزيد في VulApps...

Sudo-Security-Bypass-CVE-2019-14287

Sudo-Security-Bypass-CVE-2019-14287 =========================================================================== ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██╗ █████╗ ██╗██╗ ██╗██████╗ █████╗ ███████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗███║██╔══██╗ ███║██║ ██║╚════██╗██╔══██╗╚════██║ ██║ ██║...

CVE-2023-40931-PoC

CVE-2023-40931 حمولة sqlmap لاستغلال CVE-2023-40931 الحمولة المعلومات المطلوبة: اسم مستخدم وكلمة مرور صالحان النطاق ومسار المثيل المستضاف sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id=3&token=curl -ksX POST...

tomcat-embed-core-9.0.31-CVE-2020-11996

يرجى الاطلاع على إثبات المفهوم PoC في اختبار الوحدة testImplicitCloseLargeId من TestHttp2Section51.java: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

CVE-2021-21042

CVE-2021-21042 مستوحى من https://www.zerodayinitiative.com/blog/2021/2/17/zdi-21-171-getting-information-disclosure-in-adobe-reader-through-the-id-tag...

CVE-2024-58290-Xhibiter-SQLi

CVE-2024-58290-Xhibiter-SQLi إثبات المفهوم PoC لثغرة حقن SQL في سوق Xhibiter NFT للإصدار 1.10.2 نقطة نهاية Collections. تم اكتشافها بواسطة Sohel Yousef. CVE-2024-58290: حقن SQL في سوق Xhibiter NFT عنوان الاستغلال: Xhibiter NFT Marketplace 1.10.2 - حقن SQL بدون مصادقة التاريخ: 2024-12-11 مؤلف...

CVE-2026-105198 LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order...

CVE-2026-105198

The LatePoint (Appointment Booking Plugin) for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions before 5.7.3 . The root cause is a failure to verify that a caller owns the order referenced by an order-item identifier before rendering the confirmation summary....

CVE-2025-26788

CVE-2025-26788 إعداد البيئة الخطوة 1 - التحقق من تشغيل Docker Desktop docker version الخطوة 2 - بناء الصورة cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . الخطوة 3 - تشغيل الحاوية docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...