hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

CVE-2025-56399

CVE-2025-56399 Mass Exploit CVE-2025-56399 – Remote Code Execution in laravel-file-manager v3.3.1. Exploits misconfigured config in Laravel File Manager to upload and verify a PHP shell via unauthenticated file upload. Installation Download repository root@kitploit: git clone...

cisco-SNMP-enumeration

Cisc0wn - Cisco SNMP Script Cisco SNMP enumeration, brute force, config downloader and password cracking script. Tested and designed to work against Cisco IOS Switches and Routers. Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Daniel Compton, daniel dot compton ...

behat-config-leaks

Badges License MIT Installation...

EUVD-2026-81098

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

CVE-2026-76154 CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-82430

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-82421

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

CVE-2025-8110

Gogs RCE Exploit CVE-2025-8110 Proof of Concept for CVE-2025-8110 - Remote Code Execution in Gogs via symlink bypass and sshCommand injection. Description This exploit abuses a symlink bypass in Gogs API to overwrite .git/config and inject malicious sshCommand that executes a reverse shell...

CVE-2025-60787-POC

CVE-2025-60787 - motionEye Authenticated RCE Authenticated Remote Code Execution in motionEye = 0.43.1b4 via unsanitized motion config parameter Author: d3vn0mi Vulnerability Overview...

ai-ide-config-guard

valtik-ai-ide-config-guard Scan a repository for AI-IDE configuration files that can trigger RCE, credential theft, or persistent compromise of developer machines when the repo is opened in Claude Code, Cursor, Windsurf, Continue, or any VS Code fork. Built in response to the April 2026 AI-IDE...

EUVD-2026-80805

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields...

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Summary A query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths such as certificates or keys are appended directly to the URI's query string using string concatenation rather th...

GHSA-465G-FH3V-9JW4 RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Summary A query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths such as certificates or keys are appended directly to the URI's query string using string concatenation rather th...

CVE-2025-8110-Silentium-HTB

CVE-2025-8110 — Gogs RCE PoC Silentium / HackTheBox Disclaimer: This tool is intended strictly for educational purposes and authorized penetration testing. Only use it against systems you have explicit permission to test. This is a modified version of zAbuQasem/gogs-CVE-2025-8110, adapted to work...

CVE-2026-92917

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

BIT-MONGODB-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

BIT-MONGODB-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...