37307 matches found
CVE-2026-105637: Authorization Bypass Through User-Controlled Key
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...
CVE-2026-104975: Authorization Bypass Through User-Controlled Key
Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...
CVE-2026-88393: Undefined Security Weakness
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...
CVE-2026-88393
WookTeam version 1.6.6 and before is vulnerable to Remote Code Execution (RCE) via the project task export interface at /api/project/task/export. The root cause is that the data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php. This function ...
PT-2026-106273
Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.16.0 Description An authenticated workspace member can modify the status and parameters of another application's MCP server, which could lead to service disruption or data redirection. This occurs because the...
CVE-2018-19321
CVE-2018-19321 CVE-2018-19321 Description The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be...
CVE-2019-5420.rb
CVE-2019-5420.rb POC Exploit written in Ruby Input your cookies from the target app into the script and run via ruby ./exploit.rb...
cve-2025-55182-poc
Basic Information CVE-2025-55182 is one of the most impactful Web framework vulnerabilities of 2025. React Server Components RSC are now the mainstream architecture for modern Next.js applications, and a large number of standard projects created with create-next-app are within the affected scope,...
cve_2024_0044
CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...
rasputin
RASPutin Ressources and papers related to my conferences and work on unRASPs. These work is in progress, please be patient : Don't hesitate to contribute / contact me / do PR ! Talks Insomni'hack 2022 - Forging golden hammer against Android app protections This talk is the first from a new serie...
CVE-2025-70341
CVE-2025-70341: Небезопасные разрешения + произвольное выполнение кода в App-Auto-Patch Сводка App-Auto-Patch v3.4.2 создаёт свой рабочий каталог с правами на запись для всех пользователей chmod 777, что создаёт локальное состояние гонки TOCTOU time-of-check-time-of-use. Непривилегированный...
CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass
CVE-2025-46018 – CSC Pay Mobile App Payment Authentication Bypass Summary A payment authentication bypass vulnerability was discovered in the CSC Pay Mobile App, affecting version 2.19.4. The flaw allowed an attacker to initiate a payment, disable Bluetooth at a specific point in the process, and...
Packages_app_settings_CVE-2020-0201
This repository does not have a README...
frida-ios-dump-modern
Modern iOS IPA Dumper A modern iOS application memory decryption tool built for Frida 17.5.2+ with full support for iOS 14-16 and multiple jailbreaks. Status: ✅ Working and Tested - Successfully dumps and decrypts iOS apps using Frida 17.5.2 on: iOS 14.7.1 + Taurine jailbreak iPad mini 5 iOS...
WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
WordPress Progressify - Progressive Web App PWA plugin = 1.6.0 - Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Progressify - Progressive Web App PWA versions = 1.6.0...
packages_apps_ManagedProvisioning_CVE-2021-39692
This repository does not have a README...
universal-android-debloater-next-generation
Universal Android Debloater Next Generation !warning DISCLAIMER : Use at your own risk. We're not responsible for anything that could happen to your devices. This is a detached fork of the UAD project. This aims to improve privacy and efficiency energy, speed, memory by removing unnecessary and...
React2Shell-CVE-2025-55182-Testing-Environment
React2Shell CVE-2025-55182 Testing Environment A containerized testing environment for CVE-2025-55182, a critical 10.0 CVSS Remote Code Execution vulnerability in React Server Components. ⚠️ WARNING This environment is intentionally vulnerable and should ONLY be used for: Security research and...
CVEs
CVE List CVE-2024-22890: My e-Diary App - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22890.md CVE-2024-22909 : Online-Exam-System - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-22909.md...