cve-2025-63888-exploit

CVE-2025-63888 ThinkPHP 5.0.24 File Inclusion RCE Exploit A security research tool for detecting and testing the CVE-2025-63888 vulnerability in ThinkPHP 5.0.24, which allows Remote Code Execution through file inclusion attacks. ⚠️ Disclaimer This tool is for authorized security testing and...

CVE-2026-0740-upload-template

This repository does not have a README...

CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

CVE-2026-109310

The software SiYuan versions v3.1.12 before v3.8.6 is vulnerable to a Denial of Service attack due to a lack of restriction on the Sprig template function map within the /api/icon/getDynamicIcon content parameter. An attacker, such as a publish reader or any user if publish authentication is disa...

cryptohackapp

cryptohackapp Getting started To make it easy for you to get started with GitLab, here's a list of recommended next steps. Already a pro? Just edit this README.md and make it your own. Want to make it easy? Use the template at the bottom! Add your files Create or upload files Add files using the...

CVE-2023-43352-CMSmadesimple-SSTI--Content

CMSmadesimple SSTI v2.2.18 Author: Sergio Description: Server Side Template Injection SSTI vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Attack Vectors: A SSTI...

Nuclei-Template-CVE-2023-42793.yaml

This repository does not have a README...

CVE-2026-103528

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. CVE-2026-78659:...

SUSE-SU-2026:4629-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...

zeroqlik-detect

Description A Nuclei template to detect ZeroQlik CVE-2023-41265 and CVE-2023-41266...

CVE-2021-40444_CAB_archives

CVE-2021-40444CABarchives CVE-2021-40444 - Custom CAB templates from MakeCAB Reference ddl https://github.com/Udyz/CVE-2021-40444-CAB/blob/main/calc.dll...

CVE-2024-30270-PoC

This script is designed to exploit vulnerabilities in a Mailcow instance using Cross-Site Scripting XSS and Remote Code Execution RCE. The script aims to: Inject an XSS payload into a Mailcow web interface. Use the XSS payload to execute unauthorized actions. Achieve RCE by overwriting a server...

cve-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and...

exploit-CVE-2022-24780

iTop RCE via SSTI - CVE-2022-24780 exploit iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

CVE-2024-38856-EXP

CVE-2024-38856-EXP bash CVE-2024-23692.sh Nuclei nuclei -list target.txt -t CVE-2024-23692.yaml -o CVE-2024-23692-result.txt or nuclei -id CVE-2024-23692 -o CVE-2024-23692-result.txt...

nextjs-CVE-2025-29927

nextjs-CVE-2025-29927 A Nuclei template to detect CVE-2025-29927 the Next.js authentication bypass vulnerability. If you want to understand exactly how this vulnerability works, you can read the original researchers excellent article here This template is pretty straight forward. It does two...

Magento-APSB22-48-Security-Patches

Official Magento Patches have been released:Magento Docs These patches address the same security issues as this repository does. Except that we've added a few fixes to older Magento versions. Security patches for APSB22-48 This repository contains Magento 2 Patch Files for the recently found...

CVE-2024-4879

CVE-2024-4879 Exploit & PoC - Nuclei Template CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticate...