gokart

GoKart - Go Security Static Analysis GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA single static assignment form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces...

CVE-2023-32749-PoC

CVE-2023-32749 | Pydio Cells Unauthorised Role Assignment Exploit for CVE-2023-32749 affecting Pydio Cells 4.1.2 and earlier. A low-privileged authenticated user can create a new external user with all roles assigned, granting access to all cells and non-personal workspaces across the instance...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS Mass Assignment Privilege Escalation 📌 Project Description CVE-2025-2304 is a Mass Assignment vulnerability in Camaleon CMS versions 2.9.1 that allows an authenticated user to elevate their privileges to administrator by manipulating the role parameter in password...

secuimag3a

Based on a flaw or vulnerability either proposed by the instructor or chosen by you which must be related to the proposed theme: Specify which service or program is compromised, and what type of compromise it is Explain the vulnerability, describe the mechanism used to exploit it Does this flaw...

CVE-2025-47445-PoC

CVE-2025-47445 PoC This proof of concept is based on a school assignment where we wanted to find a vulnerable wordpress plugin and test said vulnerability in a local controlled environment. Info| ---|--- Wordpress plugin:| Wordpress Eventin Plugin version:| 4.0.26 or older CVE information:| Proje...

Mass-Assigner

Mass Assigner Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter...

CVE-2026-105040

The EnergizeLab Eilik NestJS auth service is vulnerable to a mass assignment flaw. The service accepts a user-controlled user ID during account update requests, allowing a registered user to modify another account's identifier. This vulnerability results in an account takeover , as an attacker ca...

CVE-2025-2304-POC

CVE-2025-2304-POC Manual poc for CVE-2025-2304: Camaleon CMS Version 2.9.0 Exploitation Steps 1. Log in as a low-privileged user e.g., "Bob". 2. Intercept the password change using a proxy e.g Burpsuite, caido and more 3. Capture the updatedajax request during a password change. 4. Inject the...

CVE-2025-54782

CVE-2025-54782 PoC for CVE-2025-54782 for assignment purposes...

CVE-2023-7028

GitLab CVE-2023-7028 POC [email protected]&[email protected] 科研机构base成都-招聘网络安全研究人员（私）...

HTB-Facts-Writeup

HackTheBox — Facts Machine Writeup Machine Info Field| Details ---|--- Name| Facts OS| Linux Difficulty| Easy Release| Season 10 Retired| No Attack Chain Overview Recon → Web Enumeration → CVE-2025-2304 Mass Assignment → S3/MinIO Credential Leak → SSH Key Extraction → Passphrase Cracking → User...

CVE-2025-51403

Exploit Title: LiveHelperChat 4. Save the changes. 5. Revist the Department Assignment settings page and edit the Alias Nick field, the...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope user self-service privilege escalation Improper Privilege Management CWE-269 in Apache Syncope. An authenticated, low-privilege user can grant themselves arbitrary roles and group memberships, external resources, and a new realm through the user self-service API —...

CVE-2026-109693

The Fluent CRM WordPress plugin, developed by WP ManageNinja LLC, is vulnerable to Privilege Escalation due to an Incorrect Privilege Assignment (CWE-266). This issue affects versions from n/a through 3.2.5 . An attacker with low-level privileges could potentially escalate their permissions withi...

freevulnsearch

freevulnsearch This NMAP NSE script is part of the Free OCSAF project - https://freecybersecurity.org. In conjunction with the version scan "-sV" in NMAP, the corresponding vulnerabilities are automatically assigned using CVE Common Vulnerabilities and Exposures and the severity of the...

CVE-2026-34008

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-34014

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

EUVD-2026-101984

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2024-1209

CVE-2024-1209 Sensitive Information Exposure via assignments in LearnDash. Unauthenticated visitors can browse and download uploaded assignments. Vulnerability: CVE-2024-1209 Sensitive Information Exposure via assignments CVSS: 5.3 Medium Software: LearnDash sfwd-lms Affected versions: = 4.10.1...

EUVD-2026-101975

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...