CVE-2026-39387

CVE-2026-39387 — BoidCMS Authenticated File Upload to RCE via Template Injection Description BoidCMS -l -p Arguments Flag| Description| Example ---|---|--- -u, --url| Base URL of the target BoidCMS site| http://target.com -l, --user| Admin username| admin -p, --passwd| Admin password| password123...

CVE-2026-65650

CVE-2026-65650 — PoC: Authenticated DoS in Elgg Avatar Upload Authenticated denial of service in Elgg's avatar upload feature via unbounded image dimensions, causing GD memory exhaustion. Affected: Elgg saveIconFromUploadedFile'avatar' return elggerrorresponseelggecho'avatar:resize:fail'; PHP's G...

CVE-2019-10392

CVE-2019-10392 RCE with Git Client Plugin 2.8.2 Authenticated 0x01 docker startup docker run -p 8080:8080 -p 50000:50000 jenkins/jenkins:lts-alpine 0x02 Vulnerable environment Jenkins 2.176.3 Git Client Plugin 2.8.2 https://updates.jenkins-ci.org/download/plugins/git-client/ Git Plugin 3.12.0...

EUVD-2026-102132

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

CVE-2026-58392

The OPNsense firewall and routing platform (prior to version 26.1.11 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the NTP GPS page. The root cause is that the src/www/services_ntpd_gps.php component applies legacy_html_escape_form_data() to a base64-encoded initcmd value but sub...

CVE-2026-58392 OPNsense: Stored XSS in Services: NTP GPS

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

CVE-2026-53575

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-46691

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope user self-service privilege escalation Improper Privilege Management CWE-269 in Apache Syncope. An authenticated, low-privilege user can grant themselves arbitrary roles and group memberships, external resources, and a new realm through the user self-service API —...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - Authenticated Author+ Arbitrary File Read via Directory Traversal Description The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments...

PoC-CVE-2019-12840

Exploit for CVE-2019-12840 in Webmin This repository contains a Python script that exploits the CVE-2019-12840 vulnerability in Webmin. Description The script attempts to log in to a Webmin server and then exploit the CVE-2019-12840 vulnerability. The script accepts several command-line arguments...

CVE-2024-22514-Remote-Code-Execution

CVE-2024-22514: Remote Code Execution in Agent DVR Information Description iSpyConnect.com Agent DVR 5.1.6.0 contains a vulnerability which allows the file triggered by alert commands to be redirected. The modification can allow the commands function to trigger any file on the system under the...

CVE-2024-22515-File-Upload-Vulnerability

CVE-2024-22515: File Upload Vulnerability in Agent DVR Information Description In iSpyConnect.com Agent DVR 5.1.6.0, there is a lack of verification of file type for sound file uploads. This allows an authenticated user to upload any file type through the upload audio component simply by toggling...

CVE-2021-24959

CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

CVE-2024-7985-PoC

CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload FileOrganizer Exploit - CVE-2024-7985 📌 Overview CVE-2024-7985 - WordPress Plugin FileOrganizer = 1.0.9 is vulnerable to authenticated arbitrary file uploads , allowing attackers with Subscriber+ privileges...

CVE-2026-36228

CVE-2026-36228: Easy Chat Server 3.1 Chat Message mtowho Denial of Service PoC This repository contains a benign-by-default proof of concept for CVE-2026-36228, a denial-of-service issue in Easy Chat Server 3.1 chat message handling. This repository is for authorized security research and local...

CVE-2019-19369

CVE-2019-19369 - FusionPBX = 4.5.10 Authenticated RCE Authenticated attackers can use PHP-Editor function in FusionPBX versions = 4.5.10 to edit one of the existing PHP pages to insert a PHP payload. By navigating to the changed file we are able to gain a shell as www-data. Discovered by...

CVE-2024-35584

CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...