CVE-2026-78180

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78186

A remote reachable assertion vulnerability exists in the HSS component of Open5GS up to version 2.8.0, specifically in the file src/hss/hss-cx-path.c. The flaw is triggered by manipulation of the User-Name argument, leading to an assertion failure that impacts availability . The attack requires l...

CVE-2026-78182

A SQL injection vulnerability in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System (versions up to 300R004C00B300 ) is triggered via the order/sort argument of the PlanController.getImmediatePlans function at /xbreport/api/v1/plamange/plansImmediate. The attack is remote, ...

CVE-2026-78178 jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The report...

CVE-2026-53625-GLPI-PoC

CVE-2026-53625 - PoC per l'Escalation dei Privilegi di GLPI tramite Manipolazione di authtype 📌 Panoramica Questo repository fornisce un Proof-of-Concept PoC etico per CVE-2026-53625 , una vulnerabilità di escalation dei privilegi di gravità Alta in GLPI che interessa tutte le versioni dalla 0.70...

CVE-2026-78170

UTT HiPER 1200GW (up to version 2.5.3-170306) is affected by a remote buffer overflow in the strcpy function within /goform/formConfigFastDirectionW. An authenticated attacker (low privileges) can exploit this by manipulating the ssid argument, potentially achieving full compromise of confidentia...

krbrelayx

Krbrelayx – Toolkit für Kerberos-Relaying und Missbrauch uneingeschränkter Delegierung Toolkit für den Missbrauch von Kerberos. Benötigt impacket, ldap3 und dnspython, um zu funktionieren. Es wird empfohlen, impacket direkt von git zu installieren, um die neueste Version zu erhalten. Weitere...

CVE-2026-78160

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading...

EUVD-2026-64669

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. T...

EUVD-2026-64677

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading...

NVMS-1000-Directory-Traversal-Bash

NVMS-1000-Directory-Traversal-Bash Exploit di Directory Traversal scritto in Bash per NVMS-1000 CVE-2019-20085. Utilizzo root@kitploit: ./cve-2019-20085-poc.sh -u TARGETURL -f TARGETFILE Esempio root@kitploit: ./cve-2019-20085-poc.sh -u http://127.0.0.1/ -f path/to/file.txt Dichiarazione di non...

PT-2026-80915

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

PT-2026-80858

Name of the Vulnerable Software and Affected Versions miniOrange OAuth Client versions prior to 3.2.0 Description An issue in the miniOrange OAuth Client extension for Joomla allows an attacker to log in as any account, including administrators, without requiring a valid account or prior...

PT-2026-80904

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

react-cve-2025-55182

CVE-2025-55182: React/Next.js-Test Projektstatus: Experimentell / Proof of Concept Dieses Repository dient als kontrollierte Forschungsumgebung und Proof-of-Concept PoC-Framework zur Analyse von CVE-2025-55182. Es demonstriert eine Prototype Pollution -Schwachstelle im Kontext von Next.js Server...

CVE-2025-29927-PoC

CVE-2025-29927 - Bypass dell'autorizzazione del middleware Next.js PoC Questo repository contiene un exploit Proof of Concept PoC per CVE-2025-29927 , una vulnerabilità critica in Next.js che consente agli attaccanti di aggirare i controlli di autorizzazione abusando di un header HTTP specifico d...

Spring4Shell-POC

Spring4Shell CVE-2022-22965 - Proof of Concept di Esecuzione Remota di Codice Un Proof of Concept PoC completamente containerizzato che dimostra lo sfruttamento di Spring4Shell CVE-2022-22965 , che porta all'Esecuzione Remota di Codice RCE contro un'applicazione Spring Framework vulnerabile...

CVE-2021-4034

Prova di concetto Proof of Concept: CVE-2021-4034 PwnKit Nota: Questo repository e il suo contenuto fanno parte di un Progetto Finale di Laurea GrAL, creati esclusivamente per scopi didattici e di ricerca accademica. Descrizione Questo repository contiene una prova di concetto PoC - Proof of...

dynamorio

DynamoRIO Informazioni su DynamoRIO DynamoRIO è un sistema di manipolazione del codice a runtime che supporta trasformazioni del codice su qualsiasi parte di un programma, mentre questo viene eseguito. DynamoRIO espone un'interfaccia per la creazione di strumenti dinamici per una vasta gamma di...

CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...