Exch-CVE-2021-26855_Priv

Exch-CVE-2021-26855 ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability...

CVE-2024-3408-dtale

CVE-2024-3408 - D-Tale प्रमाणीकरण बाईपास और RCE CVE-2024-3408 के लिए पुनरुत्पादित प्रयोगशाला वातावरण, जो D-Tale में प्रमाणीकरण बाईपास और रिमोट कोड निष्पादन कमजोरी है। कमजोरी D-Tale संस्करण 3.15.1 तक निम्नलिखित कारणों से कमजोर हैं: 1. हार्डकोडेड SECRETKEY "Dtale" Flask सत्र हस्ताक्षर के लिए - सत्र...

tar: tar: Hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

CVE-2026-40204

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass Access Control List ACL restrictions through the ldamailboxautocreate feature. This could potentially grant unauthorized access to mailboxes or other restricted resources. Mitigation Mitigation for this issue is either n...

CVE-2026-78319

A service running on the affected products contains a potential Time-of-Check Time-of-Use TOCTOU race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code...

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927 Authorization Bypass reproduction This repository is a reproduction of the CVE-2025-29927 vulnerability in the next package How to reproduce 1. Follow the steps below to clone, and run the Next.js application 2. Test authorization denies access to the /api/hello endpoint...

cve-2024-21413-outlook-monikerlink-lab

CVE-2024-21413 — Outlook Moniker Link Lab / PoC Educational lab notes and a small Proof of Concept PoC demonstrating the CVE-2024-21413 attack flow in a controlled environment TryHackMe-style lab. ⚠️ For educational purposes only. Do not use against systems you don’t own or have explicit permissio...

WordPress Simple Membership plugin <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability discovered by Kittipat Jitphonchana in WordPress Plugin Simple Membership versions = 4.8.1...

CVE-2026-73208

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

CVE-2024-50657

CVE-2024-50657:Incorrect Access Control on Owncloud apk An issue in Owncloud android apk v.4.4.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method. Vulnerability Type Incorrect Access Control Vendor of...

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – حقن الاستعلامات المحفوظة في GraphQL عبر التلاعب بالمعرّف كود البرنامج Node.js root@kitploit: // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ;...

EUVD-2026-68988

A service running on the affected products contains a potential Time-of-Check Time-of-Use TOCTOU race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code...

CVE-2023-2437

CVE-2023-2437 Hello, ALL , i m RxR I Coded Tool For Exploit vulnerability UserPro = 5.1.1 – Authentication Bypass to Administrator The Exploit get the user of the admin , then login with his access , to create new admin The Best way for exploit this vulnerability is create new admin for Run TooL...

fortigate-cve-2022-40684-tool

विवरण यह उपकरण सुरक्षा पेशेवरों को उजागर CMDB API endpoints के साथ इंटरैक्ट करके FortiGate उपकरणों में CVE-2022-40684 के संपर्क की पहचान और सत्यापन करने की अनुमति देता है। यह नियंत्रित वातावरणों में विश्लेषण के लिए प्रशासनिक उपयोगकर्ताओं, उपयोगकर्ता समूहों की सूचीकरण और चयनात्मक कॉन्फ़िगरेशन...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – SQL Injection Proof of Concept Team Information Team Name: The Misfits Team Members: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Overview This repository contains a vulnerable web application created as a Proof of Concept PoC to demonstrate an SQL...

CVE-2025-26198

CVE-2025-26198 - توضيح SQL Injection مشروع أكاديمي ENSIMAG - الأمن 3A المؤلفون: Wail Yacoubi, Mohammed-Yassine Akhmari التاريخ: يناير 2026 تحذير هذا الكود ضعيف عمدًا لأغراض تعليمية. لا تقم بنشره في بيئة الإنتاج أبدًا. الوصف إعادة إنتاج لثغرة CVE-2025-26198: حقن SQL حرج في مشروع...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Cleartext Storage of Sensitive Information in Memory in Abacre Restaurant Point of Sale POS. All versions of Abacre Restaurant Point of Sale POS up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid...

CVE-2024-10924

CVE-2024-10924 - Really Simple Security में प्रमाणीकरण उपेक्षा अवलोकन यह परियोजना CVE-2024-10924 के शोषण और शमन को प्रदर्शित करती है, जो WordPress "Really Simple Security" प्लगइन में एक गंभीर प्रमाणीकरण उपेक्षा भेद्यता है। चरण 1: पर्यावरण सेटअप भेद्य WordPress वातावरण प्रारंभ करें: cd...

CVE-2025-64459

CTF Challenge: Django ORM Injection CVE-2025-64459 Category: Web Security Difficulty: Medium Vulnerability: CVE-2025-64459 - Django ORM Filter Injection 📝 Description We built a secure merch shop with admin panel. Can you bypass the authentication and find the private admin note URL:...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...