composer-CVE-2026-40261-CVE-2026-40176-PoC

!CAUTION يحتوي هذا المستودع على كود إثبات المفهوم لثغرات CVE-2026-40261 وCVE-2026-40176 في Composer. !CAUTION الكود مخصص للأغراض التعليمية والاختبارية فقط. !CAUTION لا تستخدم هذا الكود في بيئات الإنتاج أو ضد أنظمة دون الحصول على إذن مناسب. !CAUTION تأكد دائمًا من حصولك على إذن قبل اختبار أي ثغرات...

CVE-2026-42208_lab

ثغرة حقن SQL في LiteLLM Proxy GHSA-r75f-5x8p-qvmc بيئة إعادة إنتاج لثغرة حقن SQL في تدفق مصادقة مفاتيح API الخاصة بـ LiteLLM Proxy. ملخص الثغرة...

CVE-2026-37749

CVE-2026-37749 — نظام إدارة الحضور البسيط من CodeAstro 1.0 - حقن SQL التفاصيل...

needrestart

needrestart About needrestart checks which daemons need to be restarted after library upgrades. It is inspired by checkrestart from the debian-goodies package. There are some hook scripts in the ex/ directory to be used with apt and dpkg. The scripts will call needrestart after any package...

CVE-2026-25546-godot-mcp-0.1.1-OS-Command-Injection

CVE-2026-25546 PoC - حقن أوامر نظام التشغيل في godot-mcp المؤلف: Mohammed Idrees Banyamer GitHub: mbanyamer التاريخ: 04 فبراير 2026 عنوان الثغرة godot-mcp 0.1.1 - حقن أوامر نظام التشغيل عبر projectPath CVE CVE-2026-25546 CWE CWE-78 عدم تحييد العناصر الخاصة المستخدمة في أمر نظام التشغيل - حقن أوام...

CVE-2026-14828

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

jsPDF-Object-Injection

CVE-2026-25755 ثغرة تجاوز الحماية في jsPDF تؤدي إلى حقن الكائنات نظرة عامة تم اكتشاف ثغرة حرجة في حقن كائنات PDF CVE-2026-25755 في jsPDF، وهي مكتبة JavaScript مستخدمة على نطاق واسع لإنشاء مستندات PDF في التطبيقات من جانب العميل. توجد الثغرة في دالة addJS، مما يسمح للمهاجمين بحقن كائنات PDF عشوائي...

PrestaShop Responsive Mega Menu Module - Remote Code Execution

The 'Responsive Mega Menu' module for PrestaShop is prone to a remote code execution and SQL injection vulnerability. modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop allows remote attackers to execute an SQL injection or...

D-Link DIR-823X set_prohibiting - Command Injection

D-Link DIR-823X 240126 and 240802 contain a command injection caused by sending a POST request to /goform/setprohibiting, letting an authorized attacker execute arbitrary commands remotely, exploit requires attacker to be authorized. id: CVE-2025-29635 info: name: D-Link DIR-823X setprohibiting -...

GLPI 10.0.10-10.0.14 - SQL Injection

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. id: CVE-2024-29889 info: name: GLPI 10.0.10-10.0.14 - SQL Injection autho...

NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

NodeBB XML-RPC Request xmlrpc.php - XML Injection

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. id: CVE-2023-43187 info: name: NodeBB XML-RPC Request xmlrpc.php - XML Injection author: 0xParth...

Chamilo LMS <= v1.11.20 Unauthenticated Command Injection

Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. id: CVE-2023-3368 info: name: Chamilo LMS = v1.11.20 Unauthenticated Command Injection...

D-Link Routers - Remote Command Injection

D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for...

Geutebruck - Remote Command Injection

Geutebruck is susceptible to multiple vulnerabilities its web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-33544 info: name: Geutebruck - Remote Command Injection author: gy741 severit...

SonicWall GMS and Analytics Web Services - Shell Injection

The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions id: CVE-2023-34124 info: name: SonicWall GMS and Analytics Web...

Kemp LoadMaster Load Balancer - Unauthenticated Command Injection

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: LoadMaster: 7.2.40.0 and above. ECS: All versions.Multi-Tenancy: 7.1.35.4 and above. id: CVE-2024-7591 info: name: Kemp LoadMaster Load Balancer - Unauthenticated Command Injection autho...

WAVLINK WN530H4 live_api.cgi - Command Injection

A remote command-line injection vulnerability in the /cgi-bin/liveapi.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication. id: CVE-2020-12124 info: name: WAVLINK WN530H4 liveapi.cgi - Command Injection author...

Netsweeper <=6.4.3 - Python Code Injection

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters. id: CVE-2020-13167 info: name: Netsweeper =6.4.4 to mitiga...

F5 BIG-IP Appliance Mode - Command Injection

When running in Appliance mode, an authenticated user assigned the Administrator role may bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. id: CVE-2022-41800 info: name: F5 BIG-IP Appliance Mode - Command Injection author: dwisiswant0 severity: high description...