r00kie-kr00kie

r00kie-kr00kie Disclaimer This is a PoC exploit for the CVE-2019-15126 kr00k vulnerability. This project is intended for educational purposes only and cannot be used for law violation or personal gain. The author of this project is not responsible for any possible harm caused by the materials...

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

CVE-2026-104136

The OpenEMR electronic health records application is vulnerable to an improper access control issue (CWE-284) in versions prior to 8.3.0 . Specifically, the new_recall branch of interface/main/messages/save.php fails to enforce patient-level or recall-workflow authorization when processing a call...

CVE-2026-104137

Prior to version 8.3.0 , OpenEMR is vulnerable to an Improper Access Control (CWE-284) issue within the sms_search branch of interface/main/messages/save.php. While the component requires an authenticated session, it fails to enforce patient or feature-level ACLs. This allows a low-privilege user...

XWiki Platform Distribution Flavor Main - Cross-Site Scripting

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting XSS due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in t...

RiteCMS 3.0.0 - Cross-site Scripting

RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the mainmenu/editsection component, letting attackers execute arbitrary scripts in the context of the victim's browser. id: CVE-2024-28623 info: name: RiteCMS 3.0.0 - Cross-site Scripting author: 0xAkoko severity: medium...

CVE-2026-122154

A vulnerability in purocean Yank Note version 3.93.0 allows for information disclosure via the Settings Endpoint . Specifically, the config.getAll function in the src/main/server/index.ts file can be manipulated to leak sensitive data. The attack can be initiated remotely , and an exploit is publ...

CVE-2026-122154 purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure

A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and...

D-Link DIR-505 Wireless Router Code Execution

The vulnerability in the main function of the /secmark1524.cgi script within the Web Management CGI interface of the D-Link DIR-505 wireless router software is related to the presence of undocumented configuration commands. Exploitation of this vulnerability may allow a remote attacker to execute...

ifuncd-up

in response to Hacker News... I see you jokers on the orange websitehn are giving me a hard time. I will make a few choice responses below, but first I offer a challenge: I will send $500 of my own money to the first person who can demonstrate this attack without ifunc. I am genuinely interested,...

CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

CLEANSTART-2024-CE90636 main/translate

Security vulnerability affects the asterisk package. main/translate...

CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu

Rite CMS v3.0 Multiple Stored XSS Author: Sergio Description: Rite CMS 3.0 is affected by a Multiple Cross-Site scripting XSS stored vulnerability that allows attackers to execute arbitrary code via a crafted payload i to the Main Menu - Items in the Administration Menu. Attack Vectors:...

CVE-2026-119342

The Stirling-PDF web application (versions 2.13.1 through 2.13.2 ) is vulnerable to a local file read (LFI) via the POST /api/v1/convert/svg/pdf endpoint. The root cause is a same-origin bypass where a scheme-less root-relative image reference evades SvgSanitizer.isExternalUrl() checks. This allo...

CVE-2026-119342 Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses...

CVE-2026-119333

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

EUVD-2026-114398

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-119333 draw.io Desktop allows Windows executable search-path hijacking

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-119333 draw.io Desktop allows Windows executable search-path hijacking

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...