rebuff

Rebuff.ai Self-hardening prompt injection detector Rebuff is designed to protect AI applications from prompt injection PI attacks through a multi-layered defense. Playground • Discord • Features • Installation • Getting started • Self-hosting • Contributing • Docs Disclaimer Rebuff is still a...

CVE-2021-4045

🔍 CVE-2021-4045: Vulnerabilidad de Inyección de Comandos en TP-Link Tapo C200 CVE-2021-4045 📌 Resumen CVE-2021-4045 es una vulnerabilidad de inyección de comandos descubierta en la cámara TP-Link Tapo C200 , que permite a un atacante tomar el control total del dispositivo con privilegios deroot...

wp2shell

wp2shell Exploit WordPress REST API route confusion CVE-2026-63030 + SQL injection CVE-2026-60137 in the batch endpoint to achieve Remote Code Execution. Vulnerabilities Route Confusion CVE-2026-63030 The WordPress REST API batch endpoint /batch/v1 does not properly isolate request routing. By...

CVE-2025-32463-EXPLOIT

Xpl0it — Sudo NSS Library Hijack | v0.0.4 Author: 0xb0rn3 | 0xbv1 Type: Proof of Concept PoC Security Research Tool CVE: CVE-2023-42456 Technique: sudo -R chroot NSS library injection → privilege escalation to root ⚠️ Disclaimer This tool is developed for authorized penetration testing and...

CVE-2025-8110-Gogs-Remote-Code-Execution

Affected Software: Gogs self‑hosted Git service versions prior to 0.13.0. Vulnerability Type: Command injection in the Git hook mechanism. Description: An attacker with push access to a repository can craft a malicious Git hook that injects commands into the post‑receive hook script, leading to...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Admin Takeover PoC for missing CSRF protection on emlog pro's AI Assistant executetool endpoint, which lets an attacker ride an admin's authenticated session to run arbitrary SQL against the site database — including a full admin account...

CVE-2025-61505

CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...

CVE-2025-67733

RESP Protocol Injection PoC Proof-of-concept demonstrating RESP Protocol Injection vulnerability via Lua script error messages in Valkey/Redis. Files backend.py Flask backend simulating a web application with shared Valkey connection connection pooling. Endpoints:...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — Inyección SQL Ciega a Ejecución Remota de Código Puerto 2083 → userRes POST → INTO DUMPFILE → Puerto 2031 Webshell → cwpsvc 🔴 Resumen de la Vulnerabilidad CVE-2026-57517 es una inyección SQL ciega crítica previa a la autenticación en versiones ≤ 0.9.8.1224. El...

CVE-2025-22381

CVE-2025-22381: Host Header Injection in Aggie Detailed analysis and Proof-of-Concept for CVE-2025-22381, a Host Header Injection vulnerability discovered in the Aggie Open-Source Project. Vulnerability Overview+ CVE ID: CVE-2025-22381 Published: October 2025 MITRE assignment Disclosed publicly:...

CVE-2026-86210

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteuseraccount.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The...

CVE-2026-86209

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /deleteuser.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-80439

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run...

CVE-2026-19862

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

CVE-2026-86208

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /deleteteacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the...

CVE-2026-86211 rabindralamsal inventory-management-system Login index.php sql injection

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been...

EUVD-2026-72101

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-86211

CVE-2026-86211 affects rabindralamsal inventory-management-system version 1.0.0 , specifically the Login component in index.php . A SQL injection vulnerability exists through manipulation of the username/password arguments, allowing a remote attacker to execute crafted queries. The CVSS 3.1 base ...

CVE-2026-86210

A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 , specifically in the ID argument of the file /delete_user_account.php. The flaw allows remote, unauthenticated attackers to manipulate the ID parameter and execute arbitrary SQL, resulting in low impact ...

EUVD-2026-72093

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteuseraccount.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The...