rails-cve-2017-17917

rails-cve-2017-17917 The project demonstrates the replication of a SQL injection vulnerability in the id parameter, and subsequently provides insights into mitigating and resolving this security issue. https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 Stack : Ruby: 3.2.2 Rails: 7.0....

CVE-2021-27513-CVE-2021-27514

exploit-eyesofnetwork Version 5.3.5 up to 5.3.10 CVE-2021-27513 / CVE-2021-27514 The brute-forcing can take a very long time on non production environement cause "sessionid" is created at every login but every sessionid generated by the app are valide for the PoC i deployed an EyesOfNetwork...

GO-2026-6753 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

CVE-2026-73072

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

CVE-2024-50970

CVE-2024-50970 Description A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

CVE-2026-109437

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

EUVD-2025-26366

A vulnerability was detected in RemoteClinic 2.0. This vulnerability affects unknown code of the file /staff/profile.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely...

EUVD-2026-104570

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

Event-ID-268-Rule-Name-SOC292-Possible-PHP-Injection-Detected-CVE-2024-4577-

This repository does not have a README...

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

Summary The MCP proxy's client-facing session ID embeds the authenticated caller's subject JWT sub claim specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification's documented session-hijacking guidance...

CVE-2023-0264

PoC for CVE-2023-0264 Keycloak vulnerability that allows session hijacking during authorization code flow See https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisites Docker curl jq python3 or another tool to serve static files on HTTP Steps to reproduce 1. Start Keycloak container with...

CVE-2024-34226

Visitor Management System 1.0 Submitter: Kha Do Vulnerability SQL injection Description SQL injection vulnerability in /php-sqlite-vms/?page=managevisitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters. Affected compone...

CVE-2024-41640

Description AML Surety Eco up to version 3.5 is affected by an un-authenticated reflected cross-site scripting. The target web application handles error in a dedicated error page accessible without any authentication containing a URL parameter that is not sanitizing user input. The provided...

CVE-2023-49969

CVE-2023-49969 Customer Support System 1.0 - SQL Injection Vulnerability in editcustomer via "id" URL Parameter Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. An attacker with malicious intent can execute SQL commands on the MySQL database by...

paniclock

PanicLock is a macOS menu bar utility that instantly disables Touch ID and locks the screen with a single click or closing your laptop lid. PanicLock fills a gap macOS leaves open: there is no built-in way to instantly disable Touch ID when it matters. Biometrics are convenient day-to-day, and...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...

AzureADEnumeration

Microsoft Entra ID Azure AD Unauthenticated Enumeration Source: EvilMist Toolkit - Invoke-EntraEnum.ps1 - https://github.com/Logisek/EvilMist 1. Tenant Discovery -TenantInfo Discovers tenant information using public APIs. 1.1 azmap.dev API Retrieves tenant details from the azmap.dev service...

EvilMist

EvilMist EvilMist is a collection of scripts and utilities designed to support cloud security configuration audit, cloud penetration testing & cloud red teaming. The toolkit helps identify misconfigurations, assess privilege-escalation paths, and simulate attack techniques. EvilMist aims to...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...