vBulletin_Routestring-RCE

CVE-2019-16759vBulletinRoutestring-RCE-PoC A vulnerability has been discovered in vBulletin which could allow for remote code execution when a malicious POST request is sent to the vulnerable application. The vulnerability is due to an input validation error while parsing a HTTP request in the...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...

CVE-2017-14980

Exploit-CVE-2017-14980 PoC exploit for CVE-2017-14980 — a stack-based buffer overflow vulnerability in Sync Breeze Enterprise 10.0.28. 📖 Full technical analysis of the exploit: 👉 https://davigsantana.github.io/posts/buffer-overflow/ About This repository contains a proof-of-concept PoC developed...

CVE-2025-63943

CVE-2025-63943 — SQL Injection in Grocery Store Management System 1.0 Overview A high-severity SQL Injection vulnerability was identified in the searchproducts.php component of Grocery Store Management System 1.0 , a PHP/MySQL-based web application created by anirudhkannan. The issue arises from...

CVE-2025-49132-Pterodactyl-Panel-Unauthenticated-Remote-Code-Execution-RCE-

CVE-2025-49132 Pterodactyl Panel - Unauthenticated Remote Code Execution RCE 🔎 Summary CVE‑2025‑49132 is a critical Remote Code Execution vulnerability affecting Pterodactyl Panel --cmd "" --path Examples python3 CVE-2025-49132-dbs.py --target victim.com --cmd "whoami" python3 CVE-2025-49132-dbs....

CVE-2024-3273-D-Link-Remote-Code-Execution-RCE

CVE-2024-3273 - D-Link Remote Code Execution RCE Exploit Description This repository contains an exploit for CVE-2024-3273 , a critical vulnerability found in specific D-Link devices that allows for Remote Code Execution RCE. The vulnerability arises from improper input validation in the...

CVE-2023-31584

CVE-2023-31584 - Cross Site Scripting vulnerability in cu/silicon Github link: https://github.com/cu/silicon Version Affected: 1 Severity and CVSS: Will update when review is done by NIST. Type: Cross Site Scripting Root Cause: Lack of proper input validation and sanitization before inserting...

zimbramail-CVE-2025-68645-poc

zimbramail-CVE-2025-68645-poc A proof-of-concept exploiting a Local File Inclusion LFI vulnerability existing in the Webmail Classic UI of Zimbra Collaboration ZCS 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. Vulnerability The...

node-pdf-generator-ssrf

CVE-2020-7740 This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack. Source Qui...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Class Input Validation Error Credits Tobias Kraze from makandra an...

CVE-2021-46704-POC

CVE-2021-46704-POC CVE-2021-46704 GenieACS Command Injection POC Affecting genieacs package, versions =1.2.0 1.2.8 How to fix? Upgrade genieacs to version 1.2.8 or higher. Affected versions of this package are vulnerable to Command Injection via the ping host argument lib/ui/api.ts and lib/ping.t...

CVE-2024-24549

Here’s a README.md for a Proof of Concept PoC demonstrating the Denial of Service DoS vulnerability in Apache Tomcat due to improper input validation of HTTP/2 requests: Proof of Concept PoC for Denial of Service DoS Vulnerability in Apache Tomcat This repository contains a Proof of Concept PoC...

React2Shell

React2Shell CVE-2025-55182 Overview This repository is my research on CVE-2025-55182, also referred to as React2Shell vulnerability. Repo consists of two main part: stand and exploit. References Some info about this security flaw: NIST HackerOne article Summary by Vercel Article by WIZ Author...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. Exploit Title:...

boa-cve-2009-4496-analysis

CVE-2009-4496 — Defensive Vulnerability Analysis Overview This repository documents a defensive analysis of CVE-2009-4496 , a historical vulnerability associated with the Boa web server. The objective of this project is to examine the vulnerability from a defensive security perspective through:...

CVE-2020-35262

CVE-2020-35262: Stored XSS in Digisol DG-HR3400 Router Vulnerability Description It has been identified that the vulnerable endpoint doesn't have server side input validation and lacks client side filtering for any malicious script injection. An attacker can use this vulnerability to inject...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof CVSS 10.0 Critical · CWE-20 · GHSA-jrh6-9hgv-mqm7 Summary Apache Traffic Server reserves @-prefixed headers @Ats-Internal, @ICAP-Status, @TCPInfo, ... for internal metadata : they live in the in-memory header...

TP-LINK - Local File Inclusion

TP-LINK is susceptible to local file inclusion in these products: Archer C5 1.2 with firmware before 150317, Archer C7 2.0 with firmware before 150304, and C8 1.0 with firmware before 150316, Archer C9 1.0, TL-WDR3500 1.0, TL-WDR3600 1.0, and TL-WDR4300 1.0 with firmware before 150302, TL-WR740N...

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce Backdoor RCE In-Depth Technical Analysis: Product Slider Pro Backdoor Vulnerability Vulnerability Basis and Cause CWE-1284 The technical origin of the vulnerability is classified as CWE-1284: "Improper Validation of...