-CVE-2022-26134

Confluence Pre-Auth Remote Code Execution via OGNL Injection CVE-2022-26134 Confluence Pre-Auth Remote Code Execution via OGNL Injection CVE-2022-26134 On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Data Center applications, highlighting a critical severit...

CVE-2025-55449

CVE-2025-55449 - AstrBot Remote Code Execution RCE Vulnerability Overview This repository contains a proof-of-concept exploit for CVE-2025-55449 , a critical Remote Code Execution RCE vulnerability in AstrBot. The vulnerability allows an attacker to execute arbitrary code on the target system by...

CVE-2026-24207

CVE-2026-24207 — NVIDIA Triton SageMaker Auth Bypass to Unauth RCE Unauthenticated attackers can reach the model-management surface of NVIDIA Triton Inference Server on the SageMaker and Vertex AI HTTP ports — bypassing the operator's --http-restricted-api configuration. Combined with the SageMak...

CVE-2026-56782-Gorse-Auth-Bypass

CVE-2026-56782 — Gorse Unauthenticated Database Dump / Restore Auth Bypass Gorse everyone is admin if request.Header.Get"X-API-Key" == m.Config.Master.AdminAPIKey return true return false func m Master dumpresponse http.ResponseWriter, request http.Request if !m.checkAdminrequest writeErrorre...

CVE-2023-49547

CVE-2023-49547 Customer Support System 1.0 - SQL Injection Login Bypass Description : Customer Support System is vulnerable 1.0 to SQL Injection. A SQL injection vulnerability in Customer Support System 1.0 enables remote, unauthenticated attackers to bypass the authentication process by exploiti...

CVE-2025-23419

🔐 TLS Session Reuse Exploit Tester $ BY XIT A Python-based tool to test potential TLS session reuse vulnerabilities that may allow authentication bypass in misconfigured servers. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Do NOT use it on systems...

React2Hell

🧨 React2Hell — CVE-2025-55182 Exploit 🔥 Next.js / React Server Remote Code Execution RCE Exploit █████▄ ▄▄▄▄▄ ▄▄▄ ▄▄▄▄ ▄▄▄▄▄▄ ████▄ ██ ██ ▄▄▄▄▄ ▄▄ ▄▄ ██▄▄██▄ ██▄▄ ██▀██ ██▀▀▀ ██ ▄██▀ ██████ ██▄▄ ██ ██ ██ ██ ██▄▄▄ ██▀██ ▀████ ██ ███▄▄ ██ ██ ██▄▄▄ ██▄▄▄ ██▄▄▄ Next.js/React Server RCE Exploit —...

CVE-2018-15473

CVE-2018-15473 SSH-Username-Enumeration-Exploit OpenSSH 2.3 7.7 Edited version of the original exploit: https://www.exploit-db.com/exploits/45233 Converted to Python3 Added username wordlist option How To Run Ensure that you install the requirements: foo@bar:$ pip3 install -r requirements.txt For...

CVE-2024-41713-PoC-exploit

CVE-2024-41713-PoC-exploit Mitel MiCollab Authentication Bypass to Arbitrary File Read ❯ ./cve-2024-41713-exploit.sh Exploiting CVE-2024-41713 to read /etc/passwd ... + Extracted users from /etc/passwd: root bin daemon adm lp mail operator games ftp nobody ❯ cat debugresponse.txt...

cve-2025-29927-lab

This repository contains a deliberately vulnerable web application built using Next.js. It is designed to demonstrate and study the security issue known as CVE-2025-29927. The goal of this project is to help security researchers, students, and bug bounty hunters understand how the vulnerability...

CVE-2025-63498

Stored XSS in cookie Alinto/SOGo Researchers: Daniil Khomichenok, Alexander Klimenko Affected Versions var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' Code of login remember set-cookie which accepts XSS injections as a paramteter value: if...

CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below

CVE-2023-37755 - Hardcoded Admin Credential in i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to Hardcoded admin credential vulnerability. These vulnerabilities could allows anyone to login as admin with just username “admin” and password “admin”. Description of product: i-doit is...

CVE-2026-29000

CVE-2026-29000 Lab Java/SparkJava lab simulating JWT/JWE authentication vulnerability related to CVE-2026-29000. The application runs on port 4567 and provides APIs to test valid login flow, forge tokens, and check dashboard. CVE Information CVE-2026-29000 affects pac4j-jwt in versions prior to...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass

CVE-2026-49230 — Apache APISIX jwe-decrypt Authentication Bypass Proof of concept for an authentication bypass in the Apache APISIX jwe-decrypt plugin. The plugin decrypts a JWE token and forwards its plaintext to the upstream, acting as an authentication gate — but it never validates the AES-GCM...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — WordPress Privilege Escalation Practical exploitation of a critical vulnerability in WordPress using the WooCommerce Payments plugin. 📌 Summary CVE-2023-28121 allows creating administrator users without authentication via the REST API. Severity: Critical CVSS 9.8 Impact: Full...

CVE-2023-51764

CVE-2023-51764 CVE-2023-51764 poc Link: https://github.com/duy-31/CVE-2023-51764 1. Add SMTP authentication 2. The script has only been tested on Kali 3. Please do not use the script for illegal purposes...

CVE-2026-49049

CVE-2026-49049 Vulnerability Analysis: Unauthenticated Arbitrary File Write in JoomShaper Helix3 Joomla This repository contains materials, technical analysis, and a Proof of Concept PoC for the critical vulnerability CVE-2026-49049 found in the outdated template framework Helix3 by JoomShaper fo...

cve-2024-3094

🛡️ Cybersecurity Project: Analyzing the XZ Backdoor in liblzma 📄 Overview This project analyzes the high-profile backdoor discovered in xz-utils liblzma , affecting versions 5.6.0 and 5.6.1. The malicious code introduced into the upstream build system targeted SSH authentication by modifying how...

CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...