CVE-2024-22939

target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc history.pushState'', '', '/' Success:...

CVE-2022-1040

CVE-2022-1040 may the poc with you 外面捡来的 curl --insecure -H "X-Requested-With: XMLHttpRequest" -X POST 'https://x.x.x.x/userportal/Controller?mode=8700&operation=1&datagrid=179&json="🦞":"test"'...

CVE-2023-25194

This tool is intended for security testing purposes only. Do not engage in any illegal activities. Any consequences resulting from misuse are solely your responsibility. The CVE-2023-25194 detection tool utilizes JNDI to load the response content returned by the DNS log platform to determine the...

cve-2016-1555

Description The module leverages an unauthenticated arbitrary command execution vulnerability in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0. The vulnerability occurs within how the router handles POST requests from 1...

CVE-2024-40498

CVE-2024-40498 Affected Application online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Description The file register.php handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail,...

CVE-2025-11077

CVE-2025-11077 - SQL Injection Author: Byte Reaper Description This vulnerability is a Blind SQL Injection in the addcontent.php file of the Online Learning Management System CVE-2025-11077, allowing an attacker to extract database information by sending crafted POST requests. Requirements : Linu...

cve-2022-1040

Environment In Python Environment3.10 It's strongly recommended to use the virtual environment pip3 install baseproxy python3.10 will raise an AttributeError if the version of pyOpenSSLdownloaded with baseproxy is too low. Reinstalling the latest version will fix it. pip3 uninstall pyOpenSSL pip3...

CVE-2026-109119

Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...

EUVD-2026-102836

Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...

CVE-2026-109119 Missing Authorization in rdiffweb

Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...

PT-2026-115578

Name of the Vulnerable Software and Affected Versions Rdiffweb affected versions not specified Description Improper Privilege Management in the user management API endpoint '/api/users/username or id' allows authenticated users to elevate their privileges to administrator. This is achieved by...

CVE-2026-111169 La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation

La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resourceid, inserting comments...

CVE-2025-5777

. PoC POST /p/u/doAuthentication.do HTTP/1.1 Host: 167.xxx.xx.x Content-Length: 5 login . The tool verfiy then 20 more requests to exploit. . Usage:- python CVE‑2025‑5777.py python CVE‑2025‑5777.py -l test.txt...

Spring4Shell-Python-Firewall-POC

Python Firewall for Spring4Shell CVE-2022-22965 Mitigation 1. Overview This project is a simple but effective firewall implemented as a Proof-of-Concept POC in Python. It's designed to act as an HTTP server that inspects incoming POST requests to detect and block the specific payload pattern...

exploit-CVE-2020-24815

exploit-CVE-2020-24815.py this is my first exploit for CVE-2020-24815 put the POST path after url !!!! Example: if the script not work change the cookie on script $ - pip install -r requirements.txt fix probleme pdftotext not installed: $ - sudo apt-get install build-essential libpoppler-cpp-dev...

react2shell

React2Shell - CVE-2025-55182 Exploit PoC A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY. ❌ DO NOT use against system...

CVE-2026-108859

A flaw was found in mcp-go. The HTTP server implementation does not restrict the size of incoming HTTP POST request bodies before buffering them into memory. A remote, unauthenticated attacker can exploit this vulnerability by sending excessively large or multiple concurrent requests, causing...

CVE-2026-108733

Frappe HR (hrms) versions before 16.11.0 , including all 14.x and 15.x releases through 15.64.3 , are vulnerable to a missing authorization flaw in the whitelisted expire_allocation method. This vulnerability allows authenticated users who lack HR roles to target another employee's Leave Allocati...

CVE-2025-57310

CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High...

PT-2026-104490

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a malicious filename is supplied to the ppress...