CVE-2025-24203-iOS-Exploit-With-Error-Logging

CVE-2025-24203 Exploit iOS 16.0 – 18.3.2 Thhe CVE-2025-24203 C exploit, targeting iOS versions 16.0 through 18.3.2 on all devices. Exploit by Ian Beer, I just added better error logging and graceful failing : Originally discovered by Ian Beer of Google Project Zero , I slightly improved its error...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

cve-2025-66723

CVE-2025-66723: inMusic Brands Engine DJ =3.0.0 through =3.0.0, 4.3.4, on all platforms macOS, Windows. Specifically tested versions found affected/vulnerable, macOS and Windows: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.3.0, 3.4.0, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.1, 4.3.0 Specifically tested versions...

CVE-2025-12673

Flex QR Code Generator ' shell.php curl -X POST "https://victimsite.com/wp-admin/admin-ajax.php" \ -F "action=flexqrupdateqr" \ -F "qrId=1" \ -F "qrData="data":"https://example.com"" \ -F "[email protected]" Details The vulnerability exists in the updateqrcode method of the...

CVE-2026-47323

camel-cxf-rest / camel-cxf / camel-knative-http Header Injection Reproducer CVE-2026-47323 This project demonstrates a message-header injection in Apache Camel's CXF and Knative HTTP header-filter strategies, tracked as CVE-2026-47323. CxfRsHeaderFilterStrategy camel-cxf-rest,...

S3-from-csp

S3-from-csp Extracts all S3 Buckets from CSP report headers and then tests for file upload vulns Install go install github.com/RandomRobbieBF/S3-from-csp@latest Run s3fromcsp file.txt...

CVE-2026-11613

CVE-2026-11613 — Divi Ajax Filter RCE | ---|--- Plugin| Divi Ajax Filter Divi Engine, premium — bukan di wordpress.org SVN Affected| semua versi = 5.1.2 lab memakai 3.1.8.4 dari mirror Patched| 5.1.3 11/08/2026 Tipe| CWE-98 — PHP Local File Inclusion, unauthenticated CVSS| 9.8 Critical...

CVE-2021-28312

CVE-2021-28312 POC and description for CVE-2021-28312 Windows NTFS Denial of Service Vulnerability Link: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28312 Reproduction From cmd: type following command cd c::$i30:$bitmap Remote exploitation possibility: Can be done by...

CVE-2025-58360-GeoServer-XXE

CVE-2025-58360: GeoServer XXE Lab Unauthenticated XML External Entity XXE Injection in GeoServer OWS/WMS Services CVSS: 9.8 CRITICAL Affected: SLDHandler.parse | | - SLDParser.parseSLD | File/SSRF Quick Start Start both vulnerab...

ExploitVelotiSmart

ExploitVelotiSmart Allows exploiting the LFI vulnerability CVE-2018-14064 https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac https://www.exploit-db.com/exploits/45030/...

CVE-2025-24801

CVE-2025-24801 PoC for GLPI RCE This repository contains a proof-of-concept script poc.py that exploits CVE-2025-24801, an LFI-to-RCE vulnerability in GLPI 10.0.17. It automates: Logging into GLPI Enabling .php uploads by updating document type settings Uploading a PHP reverse shell via the AJAX...

PoC-for-CVE-2024-7014-Exploit

PoC for-CVE-2024-7014 Exploit Proof of concept for the CVE-2024-7014 EvilVideo vulnerability in Telegram for Android versions 10.14.4 and earlier. The program uploads a malicious file disguised as a video to a Telegram channel, exploiting the security vulnerability to install malware or redirect...

CVE-2025-13595

CIBELES AI = 1.10.8 - Unauthenticated Arbitrary File Upload The Cibeles AI WordPress plugin versions 1.10.8 and below contain an unauthenticated remote code execution vulnerability in the actualizadorgit.php file. This file is directly accessible via HTTP without any authentication or authorizati...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

PutScanner

🔍 PUT Directory Scanner A penetration testing tool that identifies writable web directories via HTTP PUT method, specifically designed to detect CVE-2025-24813 Arbitrary File Upload in Apache Tomcat. 📌 Features Smart Protocol Handling : Auto-detects HTTPS/HTTP with fallback Comprehensive Checks :...

Vulnerable-Web-Application

Vulnerable Web Application What is Vulnerable-Web-Application Vulnerable-Web-Application is a website that is prepared for people who are interested in web penetration and who want to have information about this subject or to be working. In fact, the website is quite simple to install and use...

AttackTomcat

AttackTomcat Vulnerability Detection List CVE-2017-12615 PUT file upload vulnerability tomcat-pass-getshell weak authentication deployment war package Weak password brute force CVE-2020-1938 Tomcat file read/inclusion Usage Before first use, please reset the configuration file in settings. For...

CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...

CVE-2026-41940-analysis

CVE-2026-41940 — cPanel & WHM Pre-Authentication Root Bypass via Session-File CRLF Injection A Defender-Focused Technical Deep Dive 1. Executive Summary Field| Value ---|--- CVE ID| CVE-2026-41940 CVSS v3.1| 9.8 Critical — Network / Low Complexity / No Privileges / No User Interaction...

CVE-2024-52794-Discourse-Stored-XSS

CVE-2024-52794 – Stored Cross-Site Scripting XSS in Discourse Summary I discovered a stored cross-site scripting XSS vulnerability in Discourse, an open-source forum platform. The vulnerability allows an attacker to execute arbitrary JavaScript in the victim’s browser by injecting a malicious...