CVE-2026-42323 Piwigo: SQL Injection in Batch Manager

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

CVE-2026-42323 Piwigo: SQL Injection in Batch Manager

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

EUVD-2026-87135

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — InfiniteWP Client Admin Takeover Unauthenticated Admin Account Takeover in WordPress Multisite 📋 Overview InfiniteWP Client plugin for WordPress 1.13.6 contains a critical authentication bypass vulnerability affecting Multisite installations. An unauthenticated attacker can: 🔓...

CVE-2026-89055

CVE-2026-89055 — Customer Reviews for WooCommerce CusRev Authorization Bypass Python 3 PoC for CVE-2026-89055 in Customer Reviews for WooCommerce customer-reviews-woocommerce / Ivole CusRev. Description PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤ 5.120.0 is vulnerab...

CVE-2026-66491

Lectura arbitraria de archivos mediante getSource en PhocaCommander PhocaCommander ≤ 6.1.3 — Path Traversal autenticado de administrador, sin CSRF requerido RESUMEN Existe una vulnerabilidad de lectura arbitraria de archivos en el endpoint del editor de archivos de PhocaCommander. La función...

CVE-2026-26119

CVE-2026-26119 WAC RCE - CVE-2026-26119 Windows Admin Center authenticated RCE via WinREST/PowerShell invokeCommand. Usage: root@kitploit: python3 wacrce.py "" WACPASS= python3 wacrce.py Env: root@kitploit: WACBASE - override target base URL default below WACPASS - password, used if not passed...

RedSun-

RedSun The Red Sun vulnerability repository Now, normally I would just drop the PoC code and let people figure it out. But I can't for this one, it's way too funny. When Windows Defender realizes that a malicious file has a cloud tag, for whatever stupid and hilarious reason, the antivirus that's...

CVE-2024-57522

CVE-2024-57522 - Vulnerabilidad de XSS Almacenado en Users.php - SourceCodester Packers and Movers Management System 1.0 Descripción Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad de Cross-Site Scripting XSS Almacenado en el Packers and Movers Management System 1.0 d...

cve-2026-34472-auth-bypass-zte-h188a-router

CVE-2026-34472 Technical breakdown of CVE-2026-34472, an auth bypass via leaked credentials affecting ZTE ZXHN H188A V6 firmware. Summary In the tested H188A V6 builds, unauthenticated requests to the root path can reach pre-login wizard handlers and disclose sensitive data including: WLAN PSKs...

By-Poloss..-..CVE-2026-10580

CVE-2026-10580: Hippoo Mobile App for WooCommerce = 1.9.4 - Unauthenticated Authentication Bypass to Admin Takeover Unauthenticated → Administrator Account Takeover via Logic Conflation Bug 📌 Summary...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework-Toolkit Oracle WebLogic Server — SAML Authentication Bypass → Admin Takeover Exploit Framework & Mass Scanner For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for educational and...

CVE-2026-96448

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

Teldat-Router-CVE-2022-POC

Teldat Router CVE-2022-39996 & CVE-2022-39997 POC Proof of Concept for two vulnerabilities discovered in Teldat RS123 / RS123w routers. Overview CVE ID| Type| CWE| CVSS| Severity ---|---|---|---|--- CVE-2022-39996| Reflected XSS| CWE-79| 6.1| Medium CVE-2022-39997| Weak Password| CWE-521| 9.8|...

CVE-2025-59718-PoC

CVE-2025-59718 Exploit Wizard Overview This tool is a proof-of-concept PoC exploit script for CVE-2025-59718, a critical authentication bypass vulnerability in Fortinet products e.g., FortiOS, FortiProxy, FortiSwitchManager due to improper verification of cryptographic signatures in SAML messages...

CVE-2026-96448

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak allows for privilege escalation . The vulnerability exists because the system fails to inspect the contents of composite roles when verifying if a delegated administrator has permission to assign a specific role. Consequen...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

MakeMeEnterpriseAdmin

Example of successful execution: root@kitploit: ====================================================================== /\ Elevated domain admins to Enterprise admins - version 1.0 || /||\ Require: domain admin right |:||:| or more specifically DS-Replication-Get-Changes-All |/||| Vincent LE TOUX...

EUVD-2026-86539

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...