DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-scanner A command-line tool for detecting CVE-2026-...

Exploit for Improper Encoding or Escaping of Output in Synology Beestation_Os

Synology DSM Vulnerability Detection Scanner This is a scanne...

sqliv

SQLiv Massive SQL injection scanner Features 1. multiple domain scanning with SQL injection dork by Bing, Google, or Yahoo 2. targetted scanning by providing specific domain with crawling 3. reverse domain scanning both SQLi scanning and domain info checking are done in multiprocessing so the...

Exploit for CVE-2026-98432

Checks whether a Linux host may be exposed to CVE-2026-98432...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to verifypkcs7signature, but the check has the wrong sign: if...

Security Bulletin: Data Synchronization App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-101910 DESCRIPTION: ip-addres...

Exploit for CVE-2026-98432

CVE-2026-98432 - Linux Kernel IPv4 TCP Use-After-Free Vulnerab...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Wazuh PHP2Shell Detection Rules Kumpulan custom decoders, r...

PHP2Shell-Exploit-Framework-v2.0

PHP2Shell Exploit Framework v2.0 CVE-2026-109618 / CVE-202...

Alfred

WIP - Revamped Alfred 2.0 Alfred - A Modular Recon and Exploitation Framework EXPIREMTNAL PHASE Alfred is a Python-based framework designed to assist in various reconnaissance, exploitation, and post-exploitation tasks. It is highly modular, allowing users to easily add plugins to extend...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-scanner A single read-only bash script that checks...

gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...

Exploit for Unchecked Return Value in Google Brotli

CVE-2026-111497 — Node.js Brotli decoder PoC Disclaimer...

Exploit for CVE-2026-112816

lxd-scanner Local triage for CVE-2026-112816, the 10.0...

Exploit for Path Traversal in 9001 Copyparty

Work 1 — Secure REST API, Security CI, and CVE-2023-37474 cop...

nxc-vulnscan

vulnscan One NetExec module. Every Windows vuln check. L...

Primetek Primefaces 5.x - Remote Code Execution

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution. id: CVE-2017-1000486 info: name: Primetek Primefaces 5.x - Remote Code Execution author: Moritz Nentwig severity: critical description: Primetek Primefaces 5.x is vulnerable to a weak encryption fl...

Hytec Inter HWL-2511-SS - Remote Command Execution

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. id: CVE-2022-36553 info: name: Hytec Inter HWL-2511-SS - Remote Command Execution author: HuTa0 severity: critical description: | Hytec Inter HWL-2511-SS...

Cleo Harmony < 5.8.0.24 - File Upload Vulnerability

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. id: CVE-2024-55956 info: name: Cleo Harmony...