CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Proof-of-concept and technical write-up for CVE-2026-75865 , an unauthenticated arbitrary file upload leading to remote code execution in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent...

CVE-2025-32433-Eploit

CVE-2025-32433-Eploit Erlang/OTP SSH Vulnerable to Pre-Authentication RCE SSH Erlang RCE Exploit crafting SSH payload to execute an arbitrary Erlang command on the vulnerable server. Usage: python3 exploit.py -t targets.txt -p 2222 -o results.log Disclaimer: This tool is for educational purposes...

heroku-CVE-2013-0269

heroku-CVE-2013-0269 Inspect all of your heroku apps to see if they are running a vulnerable version of JSON Background A security vulnerability has been found in the Ruby JSON gem. This is the root cause for the recently-announced MySQL injection issue in Rails. A new release of the JSON gem is...

CP-PLUS-EZ-P21-CVE-2026-65893-65894

🔐 Security Analysis of the CP PLUS EZ-P21 IP Camera CVE-2026-65893 CVE-2026-65894 Arbitrary Code Execution & Improper Authentication – CP PLUS EZ-P21 IP Camera Overview This repository documents two security vulnerabilities identified in the CP PLUS EZ-P21 IP Camera , an IP-based surveillance...

CVE-2014-6271

EXPLOIT FOR CVE-2014-6271 USAGE : CVE-2014-6271.py full path to target uri command...

CVE-2026-91136

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

CVE-2026-104722

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

CVE-2020-1048

CVE-2020-1048 An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Remote Code Execution CVSS 9.8 Critical | Unsafe File Operations → Log Poisoning → Phar Deserialization → RCE Overview Laravel Ignition -c "whoami" References NVD — CVE-2021-3129 Ignition Patch 2.5.2...

CVE-2026-104722 Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

CVE-2026-104722

The Listdom: AI-powered Business Directory with Classifieds Ads Listings WordPress plugin is vulnerable to arbitrary file deletion in versions up to and including 6.1.2 . The root cause is insufficient file path validation within the LSD_Menus_IX_CSV::import function, specifically involving the i...

EUVD-2026-96299

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

CVE-2026-91136

The Divi Plus WordPress plugin (versions ≤ 2.4.0 ) is vulnerable to Unauthenticated Arbitrary File Read due to a lack of input validation on the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The SVGAnimatorController::index_permission callback returns true...

CVE-2026-91136 Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

EUVD-2026-96298

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

rails-forensics-CVE-2026-66066

rails-forensics-CVE-2026-66066 Tooling and method for answering two questions about a Rails application and CVE-2026-66066, the Active Storage and libvips arbitrary file read known as KindaRails2Shell: 1. Was I vulnerable, and for how long? 2. Was I exploited, and if so, what left the building? T...

CVE-2026-52886

Path Traversal: startswith Prefix Check Bypass Notepad++ — Arbitrary File Read viasession.xml backupFilePath Traversal Advisory GHSA: GHSA-rqfm-pw34-r7j6 CVE: CVE-2026-52886 Severity: Moderate Affected: v8.9.6.4 Patched: v8.9.7 Patch Commit: 7e66f36 Affected File: PowerEditor/src/Notepadplus.cpp...

CVE-2025-26319

CVE-2025-26319 1. Basic File Upload python flowiseexploit.py -u http://target:3000 -f localfile.txt -d /path/on/server/file.txt 2. Upload Configuration File Modify API key configuration python flowiseexploit.py -u http://target:3000 -f newapi.json -d /root/.flowise/api.json 3. Auto-generate and...

CVE-2026-Pending-Flask-Uploads-Path-Traversal-PoC

CVE-2026-XXXXX Pending: Path Traversal in Flask-Uploads Vulnerability Information Product : Flask-Uploads Version : 0.2.1 and potentially older versions Vulnerability Type : Path Traversal Directory Traversal CWE-ID : CWE-22 Severity : HIGH CVSS 7.5 Impact : Arbitrary File Write, Remote Code...

CVE-2026-102291 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...