CVE-2026-0848-PoC-Improper-Input-Validation

CVE-2026-0848 - NLTK StanfordSegmenter RCE PoC ⚠️ WARNING This code executes arbitrary commands on your system. Use ONLY in virtual machines or isolated containers. Description Functional PoC for CVE-2026-0848. Demonstrates how a malicious JAR file can execute arbitrary code when loaded by NLTK...

cve-2026-40176-cve-2026-40261

CVE-2026-40176 Composer Perforce Repository Remote Code Execution RCE 📋 Summary Command Injection vulnerability in Composer's Perforce repository driver allowing Remote Code Execution RCE through insufficient input validation in repository URL processing. 🎯 Vulnerability Details...

awesome-nodejs-security

A curated list of awesome Node.js Security resources. Learn Node.js Secure Coding techniques and best practices from Liran Tal Contents Tools Web Framework Hardening Static Code Analysis Dynamic Application Security Testing Input/Output Validation Secure Composition...

CVE-2026-39866

CVE-2026-39866 — Command Injection via unquoted workflow dispatch input Proof-of-concept lab for command injection in GitHub Actions workflow dispatch Purpose CVE-2026-39866 is a command injection bug in Lawnchair's GitHub Actions release workflow. The releaseupdate.yml file passes user input...

CVE-2026-1844

PixelYourSite PRO - Unauthenticated Stored Cross-Site ScriptingCVE-2026-1844 Overview The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pyslandingpage' parameter in all versions up to, and including, 12.4.0.2 due ...

jsPDF-Object-Injection

CVE-2026-25755 Sandbox Bypassed jsPDF Flaw to Object Injection Overview A critical PDF Object Injection vulnerability CVE-2026-25755 was discovered in jsPDF, a widely-used JavaScript library for generating PDF documents in client-side applications. The vulnerability exists in the addJS function,...

CVE-2026-0709

Hikvision Wireless AP – CVE-2026-0709 Authenticated RCE Tool This tool is a Python proof‑of‑concept to test Hikvision wireless access points for CVE‑2026‑0709 , an authenticated command injection vulnerability that can lead to remote code execution on affected devices. For security testing and...

PurpleLlama

🤗 Models on Hugging Face | Blog | Website | CyberSec Eval Paper | Llama Guard Paper Purple Llama Purple Llama is an umbrella project that over time will bring together tools and evals to help the community build responsibly with open generative AI models. The initial release will include tools an...

CVE-2025-55854-PoC

CVE-2025-55854 - Stored Cross-Site Scripting XSS Vulnerability Vulnerability Overview CVE ID: CVE-2025-55854 Vulnerability Type: Stored Cross-Site Scripting XSS Severity: High Affected Component: User Profile Bio Field Affected Application: FreelanceHub https://github.com/nooncarlett/FreelanceHub...

CVE-2026-3055

CVE-2026-3055 - Security Vulnerability Severity: N/A CVSS: N/A Impact: N/A Published: 2026-03-23 Legal For authorized security testing only. Root Cause short version Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread...

CVE-2025-41089

CVE-2025-41089: Reflected XSS in Xibo CMS I have discovered a Reflected Cross-Site Scripting XSS vulnerability in Xibo CMS v4.1.2. This issue stems from the application's failure to properly sanitize user-supplied input in the 'Configuration Name' field of certain widgets within the template...

CVE-2026-2256-PoC

CVE-2026–2256 PoC Executive Summary A critical command injection vulnerability CVE-2026–2256, CVSS X.X was identified in the Shell tool component of the MS-Agent framework version 1.5.2. The vulnerability arises from improper sanitization of user-influenced input that is passed directly to a shel...

CVE-2026-91133

The open-source discussion platform Discourse is vulnerable to an information disclosure flaw in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . Authenticated users can provide unescaped SQL LIKE metacharacters in upload-resolution patterns. This allows wildcard input to select unr...

CVE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

EUVD-2026-86299

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

exploit_cms_fuel

Fuel CMS 1.4.1 - Remote Code Execution RCE Exploit This repository contains a Python 3 implementation of an exploit for Fuel CMS version 1.4.1. The script leverages CVE-2018-16763 , a vulnerability where insufficient input validation in the filter and preview parameters allows for PHP Code...

CVE-2025-32000

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...

elfloader

Summary elfloader is a super simple loader for ELF files that generates a flat in-memory representation of the ELF. Pair this with Rust and now you can write your shellcode in a proper, safe, high-level language. Any target that LLVM can target can be used, including custom target specifications...

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario-

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario- A MediaTek modem input validation issue can cause a system crash remote DoS when a UE connects to a rogue base station controlled by an attacker with no user interaction required. The provided check.sh code is used to: 1...

Log4j_Vulnerability_Demo

Log4jVulnerabilityDemo A simple program to demonstrate how Log4j vulnerability can be exploited CVE-2021-44228 Running the Demo : To start the program, simply run the start.sh on UNIX systems or start.bat on Windows. User input will be read and logged to console using the Log4j framework. By...