CVE-2023-23752

CVE-2023-23752 simple program for joomla CVE-2023-23752 scanner, This is a simple Ruby script that checks if a list of targets is vulnerable to CVE-2023-23752, a critical security vulnerability in a web application. The script sends a HTTP GET request to a specified endpoint, and extracts...

SOC227-Microsoft-SharePoint-Server-Elevation-of-Privilege-Possible-CVE-2023-29357-Exploitation

SOC227 - Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 Exploitation CVE-2023-29357 is a critical privilege escalation vulnerability that, when combined with other vulnerabilities, could potentially lead to remote code execution. The CVSS score for this vulnerability is 9.8...

CVE-2004-2271-MiniShare-1.4.1-Buffer-Overflow

CVE 2004-2271 MiniShare-1.4.1-Buffer-Overflow https://vulners.com/cve/CVE-2004-2271 Usage in file, generates a msfvenom payload automatically because I'm lazy. Ported from: https://www.exploit-db.com/exploits/636/...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

Reprise License Manager 14.2 - Cross-Site Scripting

Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activateprocess "count" parameter via GET. id: CVE-2021-45422 info: name: Reprise License Manager 14.2 - Cross-Site Scripting author: edoardottt severity: medium description: | Reprise License Manager 14.2...

Extreme Management Center 8.4.1.24 - Cross-Site Scripting

Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

CVE-2026-37070

CVE-2026-37070 Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2025-50365_CSRF_DELETE_CATEGORY-phpgurukul-CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Client Side Request Forgery Affected Versions: v1.0 💣Vulnerability Description: A Cross-Site Request Forgery CSRF vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing...

CVE-2026-111472

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...

EUVD-2026-102826

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...

CVE-2026-103911

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-103911

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to properly validate values before passing them to the do_shortcode function. An unauthenticated attacker can trigger this ...

EUVD-2026-102646

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value...

Drupal-cve-2019-6340

Research CVE 2019-6340 The site as Drupal 8 core RESTful API Services module gets enabled and allows the user to send GET, PATCH or POST Request to the server. GET request is enough to trigger the code execution vulnerability even though PATCH method is disabled The site has any other web service...

CVE-2025-25296

CVE-2025-25296 Proof of Concept POC Description This project demonstrates a Proof of Concept POC for the CVE-2025-25296 vulnerability affecting Label Studio, an open-source data labeling tool. The vulnerability resides in the /projects/upload-example endpoint, which fails to sanitize user-provide...

CVE-2026-30498

CVE-2026-30498 – CSRF Vulnerability AdminPanel 4.0 Overview CVE ID: CVE-2026-30498 Reserved by MITRE Discoverer: Mehdi Ben Hamou A Cross-Site Request Forgery CSRF vulnerability exists in the delete.php endpoint of AdminPanel 4.0. This vulnerability allows an attacker to trigger sensitive actions...

PYSEC-2026-4317 wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

Summary The trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can embed a single tag on a malicious page; when an authenticated trainer...

CVE-2024-57241

CVE-2024-57241CNNVD-2024-34500830 For web applications using DEDECMS 5.71SP1 and earlier, URL redirects occur because the source code logic error of the CMS does not judge the input GET request For web applications using DEDECMS 5.71SP1 and below, URL redirection occurs because the CMS source cod...

CVE-2020-14882

CVE-2020-14882 CVE-2020–14882 - research by Jang Code by @s1kr10s Poc: POST Review / Video: https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf https://www.youtube.com/watch?v=JFVDOIL0YtA&feature=youtu.be...

PT-2026-114237

Name of the Vulnerable Software and Affected Versions YOURLS versions prior to 1.10.5 Description An unauthenticated remote attacker can perform a directory traversal attack to include and execute local PHP files already present on the server. This occurs because the yourls get request function...