CVE-2026-5173

🦊 CVE-2026-5173: GitLab WebSocket Unauthorized Method Execution PoC 🛠️ Overview CVE-2026-5173 allows a low-privileged authenticated attacker to call restricted backend methods through GitLab's WebSocket /-/cable endpoint, specifically via the GraphqlChannel. This can lead to sensitive data exposur...

CVE-2025-69821-Beat-XP-Vega-Smartwatch-Security-Assessment

CVE-2025-69821 : Beat-XP-Vega-Smartwatch-Security-Assessment A security assessment of the Beat XP VEGA Smartwatch Firmware RB303ATV006229 focused on Bluetooth Low Energy BLE connectivity revealed a design and implementation weakness that enables a nearby BLE central device to establish and retain...

ble_proxy

BLE HTTP Proxy System A Bluetooth Low Energy BLE based HTTP proxy system that routes web browser traffic through an iOS device. This allows web browsing through the iOS device's internet connection using BLE as the transport layer. Architecture Overview Browser → Windows Proxy → BLE/TCP → iOS/Moc...

CVE-2026-22017-Firmware-Update-via-BLE-Without-Authentication

CVE-2026-22017 – Firmware Update via BLE Without Authentication Program Code Python bleak peripheral blefirmwareupdate.py - Simulated BLE peripheral accepting firmware writes from bleak import BleakServer, BleakGATTCharacteristic import asyncio class FirmwareService: def initself: self.firmwareda...

privilege-escalation-breach

Security breach project - Privilege escalation The vulnerability is in Oracle Solaris, a product of Oracle Systems component: XScreenSaver. The supported version that is affected is 11. It's an easily exploitable vulnerability which allows low privileged attackers with logon to the infrastructure...

CVE-2024-48307POC

jeecg-boot getDictItemsByTable interface exists SQL injection vulnerability Parameters: options: -h, --help show this help message and exit -u URL, --url URL Please enter the URL to be detected -f FILE, --file FILE Please enter the file path containing one URL per line -c CONTENT, --content CONTE...

Vulnerabilities in Oracle JD Edwards EnterpriseOne

Oracle has identified several vulnerabilities in Oracle JD Edwards EnterpriseOne Tools, specifically in versions 9.2.0.0 through 9.2.26.5. These vulnerabilities allow attackers to gain access to the system using various network protocols such as HTTP, HTTPS, and SMTP, either without authenticatio...

CVE-2026-34213

CVE-2026-34213 A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace. Intro I identified, responsibly disclosed, and reproduced a High-severity authorization flaw in Docmost , the...

CVE-2026-1122-IoT-Firmware-Update-Signature-Bypass-via-Low-Order-Point-Injection

5. CVE-2026-1122 – IoT Firmware Update Signature Bypass via Low‑Order Point Injection Overview An IoT device’s OTA firmware verification uses a flawed Ed25519 implementation that does not reject public keys with small‑order components, allowing an attacker to forge a valid signature for malicious...

Cisco-FMC-honeypot

FMC-Trap A low-interaction honeypot that mimics a Cisco Secure Firewall Management Center FMC web surface and captures unauthenticated Java serialization-style attack traffic CVE-style insecure deserialization probes. Safe by design: the application does not deserialize Java objects; it detects...

CVE-2025-65271

CVE-2025-65271 PoC for CVE-2025-65271 How to run? node server.js Description Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard...

CVE-2025-29093-Arbitrary-File-Upload

CVE-2025-29093-Arbitrary-File-Upload This repository reveals a security vulnerability discovered in Motivian Content Management System v.41.0.0. CVE-2025-29093: Arbitrary File Upload This vulnerability was reported to the vendor in accordance with responsible disclosure practices, and to MITRE,...

CVE-2025-63666

CVE-2025-63666 — Tenda AC15 Summary Tenda AC15 firmware V15.03.05.18multi issues an authentication cookie in the form password= and returns it without HttpOnly, Secure, or SameSite flags, exposing the password hash to the client. The low-entropy suffix acts as a predictable session identifier,...

Oracle MySQL Server 26.x.x < 26.10.0 (October 2026 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

portabilis-ieducar-user-type-privilege-escalation

Portabilis i-Educar = 2.1.13 Privilege Escalation Through Arbitrary Request to User Type Change Endpoint Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation during arbitrary requests to user types endpoints i...

MAL-015

MAL-015: Isolation Escape 2 in Ansible Tower Installations of Ansible Tower on certain Rhel 7/8 setups are potentially vulnerable to “Job Isolation” Escapes that allows an attacker to elevate to the “awx” user from outside the isolated environment. The following files/setups can be leveraged by...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all...

MAL-002

MAL-002: Force System Restart via Installed Windows MSIs Once a software is successfully installed on the system, one or more trusted MSI files will appear in the “C:\Windows\Installer” folder and may allow a low privilege user to perform “repair” and/or “modify” actions as the “NT...

smart-sketcher-upload

smART Sketcher 2.0 - Bluetooth Authentication Bypass CVE-2026-0842 | Missing Authentication on BLE Interface Overview The smART Sketcher 2.0 is a Bluetooth-enabled toy projector that lets kids trace images. It has no authentication on its Bluetooth connection - anyone within range can connect and...

CVE-2026-26717

CVE-2026-26717: HMAC Timing Attack in OpenFUN Richie LMS Author: Elvin Latifli CVE ID: CVE-2026-26717 Severity: Medium CVSS 3.1: 4.8 — AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Product: OpenFUN Richie all versions prior to commit a1b5bbd Affected Component: src/richie/apps/courses/api.py —...