cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 Vulnerability Lab Educational lab demonstrating exploitation of CVE-2018-7600 Drupalgeddon2 using a vulnerable Drupal 7.56 environment deployed with Docker. This project simulates a real-world vulnerability assessment workflow, including: Vulnerable environment setup...

react2shell-cve-2025-55182

🚨 React2Shell - CVE-2025-55182 Exploitation Framework Advanced exploitation framework for CVE-2025-55182 Next.js Remote Code Execution Author: opsecramdan 📚 Table of Contents Overview Vulnerability Details Features Requirements Installation Usage Interactive Shell Output Files Impact Mitigation...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0 Accept: / Origi...

CVE-2026-33917_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-33917 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...

WordPress Quick PayPal Payments: Payment Button & Form plugin <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Quick Paypal Payments versions = 6.0.4...

CVE-2023-48104

CVE-2023-48104 HTML Injection in Alinto/SOGo Web Client Vendor of Product Alinto Vulnerability Type HTML Injection Affected Versions SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Discoverer Spiridonov Ivan/E1tex PoC For demonstration purposes only. P...

CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

EUVD-2026-102143

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

CVE-2024-2242

CVE-2024-2242 Contact Form 7 history.pushState'', '', '/'; document.forms0.submit;...

CVE-2024-5084

Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...

CVE-2025-55182-Scanner

🛡️ CVE-2025-55182 Scanner React2Shell Developed by:SainiON Hacks A standalone GUI tool to detect and demonstrate the React Server Components Remote Code Execution RCE vulnerability CVE-2025-55182 in Next.js applications. 📺 Demo & Tutorial Watch the full breakdown and tool demonstration on my...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

cve-2025-66478_rce_vulnerable

Modern Blog with shadcn/ui A modern and elegant blog built with Next.js 16, React 19, shadcn/ui and Tailwind CSS. IMPORTANT: Next JS VULNERABLE project created solely for educational, testing and exploitation purposes, NOT RECOMMENDED FOR PRODUCTION DEPLOYMENT, ONLY FOR LOCAL OR CONTROLLED...

CVE-2017-5638

LAB 1 — Apache Struts2 OGNL Injection CVE-2017-5638 / S2-045 I. SYSTEM ANALYSIS Attack Surface Analysis After starting the container, Struts2 logs show that the application loads familiar configuration files such as struts-default.xml , struts-plugin.xml , and struts.xml. This confirms that the...

CVE-2025-3515

CVE-2025-3515 CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7 Description: Arbitrary file uploads via drag‑and‑drop‑multiple‑file‑upload-contact‑form‑7 ≤1.3.8.9 allow upload of .phar files, leading to remote code execution in Apache+modphp :contentReferenceoaicite:29index=29...

CVE-2026-109892 WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13...

EUVD-2026-102051

Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13...

CVE-2026-109892

The Frontend Admin by DynamiApps WordPress plugin (versions

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

Reflected XSS in Login Form Email & Password Fields Vvveb CMS v1.0.7.2 Author: Andrew Paul Date of Discovery: August 12th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.7.2 and likely prior versions CVE ID: CVE-2025-9728 Summa...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Unauthenticated Privilege Escalation Author: Hyun Chiya Vulnerability Information Field| Value ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Affected Versions| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST...