CVE-2026-108688

Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...

AI-FILE

AIfile aifile is a Mythic C2 profile that uses the publicly documented OpenAI Files API to exchange implant messages through jsonl files instead of a traditional HTTP/S listener. It relies on the Files API behavior defined by OpenAI in the public documentation:...

CVE-2026-108603 slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

EUVD-2026-96429

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

magento-swf-patched-CVE-2011-2461

magento-swf-patched-CVE-2011-2461 Patched version of the uploader.swf and uploaderSingle.swf to fix CVE-2011-2461 More info about the vulnerable .swf files in the Magento's core can be found here - https://packetstormsecurity.com/files/131376/Magento-eCommerce-Vulnerable-Adobe-Flex-SDK.html The...

CVE-2017-5638

CVE-2017-5638 Google Dork : "site:com filetype:action"...

CVE-2026-108591 InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool

InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with filescreate permission to read server files by abusing the AI Core MCP fileupload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to filegetcontents,...

CVE-2022-48197

CVE-2022-48197 Since Yahoo is no longer updating the project per this announcement: https://yahooeng.tumblr.com/post/96098168666/important-announcement-regarding-yui, I've decided to disclose the vulnerabilities here: The application has a lot of reflected XSS vulnerabilities in pretty much most...

CVE-2025-26633

CVE-2025-26633 - MSC EvilTwin PoC Proof of Concept PoC for CVE-2025-26633 vulnerability exploiting Microsoft Management Console MMC About This PoC simulates the CVE-2025-26633 vulnerability, discovered by Trend Micro, which exploits the loading of malicious .msc files for remote command execution...

CVE-2020-17519

CVE-2020-17519 Log Traversal Tool A Python tool that uses a directory traversal technique to request log files from a target URL. It displays real-time progress, supports proxy configuration, and optionally saves valid responses. Features Directory Traversal with Configurable Depth Uses a...

CVE-2017-11882-Preventer

CVE-2017-11882-Preventer Chrome Extension CVE-2017-11882 Preventer for .docx files...

CVE-2024-24919

Exploit for CVE-2024-24919 Description This Python script is an exploit for CVE-2024-24919, a CVE that hitted Check Point Products: CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Spark Appliances Versions: R77.20 EOL, R77.30 EOL, R80.10 EOL, R80....

CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit

CVE-2024-0670 – CheckMK Agent Local Privilege Escalation PoC This repository contains a simple and clean proof-of-concept for CVE-2024-0670, a local privilege escalation vulnerability in the CheckMK Windows Agent. A low-privileged user can gain SYSTEM privileges by abusing writable temp file path...

CVE-2022-31901

CVE-2022-31901 Denial Of Services DOS in Notepad++x86 in 8.4.3 and before. Description Vulnerability triggering, via opening two specially crafted text files e.g. first.txt & second.txt as input to notepad++. As an illustrative example below, as of 11/07/2022, latest version of Notepad++x86 is...

mud-visualizer

Visualizzatore di Manufacturer Usage Description MUD Attenzione: mud-visualizer è attualmente in beta. Usalo a tuo rischio. Questo strumento può essere utilizzato per visualizzare i file MUD in formato JSON. Indice Motivazione Installazione Astrazioni MUD supportate Contributi Supporto Citazione...

HTB-Devvortex-CVE-2023-2375-PoC

Joomla! CVE-2023-23752 - Unauthenticated Information Disclosure PoC Description This repository contains a Proof of Concept PoC exploit for CVE-2023-23752, a vulnerability in Joomla! that allows unauthenticated information disclosure. This vulnerability can expose sensitive information, including...

CVE-2017-9606

CVE-2017-9606 Due to insufficient of checking integrity, authenticity and low user rights on update folder local user can craft fake ViPNet update files with arbitrary execution code and place them in ViPNet update folder. After placing fake update files in ViPNet update folder, ViPNet update...

MAL-2026-17755 Malicious code in agent-vx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90f0a2b273b0361ffd4057f114f1be1eaf9469c9746d2737a21947905570ff80 On import agentaix, the package's init.py runs a top-level installmanage side effect that renames a bundled readme.txt into manage.py and launches it...

CVE-2026-94538

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-97348

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...