CVE-2026-111629

IoTSharp versions through 3.6.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Customers and Devices API handlers. The root cause is a failure to scope database queries to the caller's specific tenant, allowing any authenticated user to access data from other te...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...

CVE-langgraph

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual environment python -m venv...

CVE-2026-111397

The WordPress MapSVG plugin (versions

CVE-2026-111397 WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1...

WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nixxies in WordPress Plugin MapSVG versions = 8.16.1...

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report This post-incident report examines the 2025 supply chain breach targeting Oracle Cloud’s identity and authentication infrastructure. It details how threat actors exploited an unpatched pre-authentication Remote Code Execution vulnerability...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – GraphQL Batching Alias Rate Limit Bypass Program Code Node.js + Python Exploit // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema = require'graphql'; const schema =...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

VMware vCenter Server LDAP Broken Access Control

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls. id: CVE-2020-3952 info: name: VMware vCenter Server LDAP Broken Access Control author: 0xAkoko severity: critic...

Palo Alto Networks Expedition - OS Command Injection

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

CVE-2026-111132

A flaw was found in libgxps. An attacker can exploit this vulnerability by convincing a user to open a specially crafted XML Paper Specification XPS document containing malformed curve segment attributes. Successful exploitation triggers an out-of-bounds memory read, primarily causing an...

DEBIAN-CVE-2026-111132

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in pathgeometrystartelement that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XP...

CVE-2026-35678

Vulnerability Research Report: All Eduplus Student ERP Insecure Direct Object Reference IDOR Researcher: Vinay Sharma 1. Executive Summary This report details a high-severity security vulnerability identified in the Eduplus Student ERP platform, specifically within the student learner portal...

CVE-2021-43798-poc

CVE-2021-43798-poc Grafana8.x Arbitrary File Read python CVE-2021-43798-poc.py http://152.136.149.237:3000 /etc/passwd...

CVE-2026-110361 WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...

CVE-2026-110361

The WordPress Infinite Uploads plugin (versions

WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peter Tang in WordPress Plugin Infinite Uploads versions = 3.4.1...

CVE-2024-55457-PoC

CVE-2024-55457-PoC MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of...

CVE-2023-49339

CVE-2023-49339 Security Vulnerability Report: Ellucian Banner System Introduction This document outlines a critical security vulnerability found in the Ellucian Banner System, particularly in version 9.17 and earlier versions. The vulnerability has been identified in systems used by various...