St. Joe ERP system - SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

SolarWinds Serv-U - Denial of Service

SolarWinds Serv-U contains a denial of service vulnerability caused by specially crafted POST requests with Content-Encoding: deflate, letting unauthenticated attackers crash the Serv-U service, exploit requires no authentication. id: CVE-2026-28318 info: name: SolarWinds Serv-U - Denial of Servi...

extended-xss-search

Extended XSS Searcher and Finder This is the extended version based on the initial idea already published as "xssfinder". This private version allows an attacker to perform not only GET but also POST requests. Additionally its possible to proxy every request through Burp or another tunnel. First...

XSSTRON

XSSTRON, Electron JS Browser To Find XSS Vulnerabilities Powerful Chromium Browser to find XSS Vulnerabilites automatically while browsing web, it can detect many case scenarios with support for POST requests too Installation Install Node.js and npm https://www.npmjs.com/get-npm or sudo apt insta...

CVE-2026-128017

FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SGrequestinfo.contenttypedup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whol...

CVE-2026-126266

SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected...

CVE-2026-126306

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw allows low-privileged users to upload crafted SVG images designed to submit authenticated POST requests to arbitrary backend endpoints. An attacker can trick an admi...

EUVD-2026-123835

A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests...

CVE-2026-126161

A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests...

CVE-2026-126161

A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests...

CVE-2026-126161

Fortinet FortiMail (versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, and 7.4.0 through 7.4.6) is susceptible to an uncontrolled resource consumption vulnerability (CWE-400). This flaw allows a remote unauthenticated attacker to cause a denial of service (DoS) by sending repeated unauthenticated...

CVE-2025-55182_RCE_Exploit

CVE-2025-55182RCEExploit REC Exploit is a Python-based security testing tool that automates detection of potential RCE conditions in web applications under authorized environments. It sends crafted POST requests to targets, analyzes server responses for execution indicators, and supports batch...

CVE-2026-126161: Fortinet FortiMail: A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through…

A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests...

PT-2026-145492

Name of the Vulnerable Software and Affected Versions FortiMail versions 8.0.0 through 8.0.1 FortiMail versions 7.6.0 through 7.6.6 FortiMail versions 7.4.0 through 7.4.6 Description An uncontrolled resource consumption issue allows a remote unauthenticated attacker to trigger a denial of service...

Uncontrolled resource consumption in fortiweb2

An Uncontrolled Resource Consumption vulnerability CWE-400 in FortiMail may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests...

EUVD-2026-116893

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...

CVE-2026-121936 easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...

CVE-2026-121936: cosin2077 easyVoice: easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...

PT-2026-136956

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...

PT-2026-137220

Name of the Vulnerable Software and Affected Versions tsParticles versions prior to 4.3.1 Description The HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST requests at the '/mcp' endpoint. The system accumulates every request-body chunk in a Buffer without a cumulative size limit...