CVE-2026-109558

Versions 1.6.0 through 1.112.0 of EdgeEver are vulnerable to a stored cross-site scripting (XSS) vulnerability in the TemplatesPane.tsx component. The root cause is the rendering of template contentMarkdown as raw HTML using dangerouslySetInnerHTML without proper sanitization. An attacker can uti...

CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

CVE-2023-49964

CVE-2023-49964: FreeMarker Server-Side Template Injection in Alfresco An issue was discovered in Hyland Alfresco Community Edition =7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage...

react2shell-PoC

React2Shell Nuclei template for detecting React2Shell CVE-2025-55182 and CVE-2025-66478...

CVE-2022-24086

CVE-2022-24086 PoC of CVE-2022-24086 var this.getTemplateFilter.addAfterFilterCallback"system".filter"whoami"...

CVE-2025-49113-nuclei-template

Nuclei vulnerability detection template - CVE-2025-49113 - Roundcube ≤ 1.6.10 Post-Authentication Remote Code Execution CVE ID: CVE-2025-49113 Severity: Critical CVSS 10.0 Discovered by: Kirill Firsov FearsOff Date Disclosed: June 1, 2025 Fixed in: Roundcube 1.6.11 / 1.5.10 LTS -...

CVE-2019-8331

Eng Description CVE-2019-8331 is a Cross-Site Scripting XSS security vulnerability found in Bootstrap, a JavaScript library widely used for developing websites and mobile applications. This vulnerability occurs because Bootstrap does not properly sanitize data sent via thedata-template attribute ...

cve-2024-6387-nuclei-template

CVE-2024-6387 Nuclei Template Nuclei template to detect CVE-2024-6387 regreSSHion by OpenSSH software version...

CVE-2022-26923

CVE-2022-26923 As described by Tenable: Active Directory Domain Services Elevation of Privilege Vulnerability CVSS v3 Base score: 8.8 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Severity: High Summary: CVE-2022-26923 exploits a vulnerability in Microsoft Active Directory Certificate...

CVE-2026-8037-POC

CVE-2026-8037-POC Includes executable command detection and one-click getshell requires server deployment service pco.yaml can be used with nuclei for quick detection Quick Start Interactive Mode python go.py Enter target URL → select function menu. Detection Target Fast detect 8 basic info items...

Ultimate-CVE-2026-61511

CVE-2026-61511 – Proof of Concept Educational and defensive Proof of Concept PoC for validating exposure to the vBulletin vulnerability CVE-2026-61511 – Unauthenticated Remote Code Execution. Contact Telegram: https://t.me/thecodeb0ss Overview This repository provides a defensive detection and...

CVE-2026-109310

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

CVE-2025-49113

CVE-2025-49113 Detection NOTE This template has now been implemented into CERT Polska's tool Artemis. I’m deeply honoured to be acknowledged by CERT Polska for this vulnerability detection script. It is a true privilege to play a part in strengthening global cyber security efforts through...

cve-2025-63888-exploit

CVE-2025-63888 ThinkPHP 5.0.24 File Inclusion RCE Exploit A security research tool for detecting and testing the CVE-2025-63888 vulnerability in ThinkPHP 5.0.24, which allows Remote Code Execution through file inclusion attacks. ⚠️ Disclaimer This tool is for authorized security testing and...

CVE-2026-0740-upload-template

This repository does not have a README...

CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

CVE-2026-109310

The software SiYuan versions v3.1.12 before v3.8.6 is vulnerable to a Denial of Service attack due to a lack of restriction on the Sprig template function map within the /api/icon/getDynamicIcon content parameter. An attacker, such as a publish reader or any user if publish authentication is disa...

CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

cryptohackapp

cryptohackapp Getting started To make it easy for you to get started with GitLab, here's a list of recommended next steps. Already a pro? Just edit this README.md and make it your own. Want to make it easy? Use the template at the bottom! Add your files Create or upload files Add files using the...

CVE-2023-43352-CMSmadesimple-SSTI--Content

CMSmadesimple SSTI v2.2.18 Author: Sergio Description: Server Side Template Injection SSTI vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Attack Vectors: A SSTI...