135370 matches found
CVE-2023-27372
CVE-2023-27372 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows...
CVE-2025-27590
CVE-2025-27590 - PoC Exploit Command Injection via Multipart Form Upload π Description This is a Proof-of-Concept PoC exploit for CVE-2025-27590 , a command injection vulnerability affecting web applications that process multipart file uploads without proper sanitization. The vulnerability allows...
CVE-2018-14699
CVE-2018-14699 UnAuth Command injection in the enableuser function of DroboAccess v2.1 Usage: To use First startup a listener ncat -nvlp 1337 Next run the exploit example: exploit.py -t 192.168.1.122:8080 -l 192.168.1.2 -p 1337 '-t', '--target', help='host for exploitation, ex...
CVE-2024-48246
CVE-2024-48246 Vehicle Management System 1.0 - Stored Cross-Site Scripting XSS Description Vehicle Management System 1.0 contains a Stored Cross-Site Scripting XSS vulnerability in the Name parameter of /vehicle-management/booking.php. A malicious actor can inject malicious payloads into the Name...
CVE-2019-10685
CVE-2019-10685 The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the "TextField" parameter. Exploit-DB publication at https://www.exploit-db.com/exploits/46804 PacketStorm publication at...
Parth
Parth EscΓ‘ner HeurΓstico de ParΓ‘metros Vulnerables IntroducciΓ³n Algunos nombres de parΓ‘metros HTTP estΓ‘n mΓ‘s comΓΊnmente asociados con una funcionalidad que con otras. Por ejemplo, el parΓ‘metro ?url= suele contener URLs como valor y, por lo tanto, a menudo es vΓctima de ataques de inclusiΓ³n de...
CVE-2025-30208
CVE-2025-30208 Detection Tool Vulnerability Analysis Vite Arbitrary File Read Vulnerability Analysis and Reproduction CVE-2025-30208 Introduction This tool is used to detect whether a target system is vulnerable to CVE-2025-30208. This vulnerability allows an attacker to read sensitive files such...
CVE-2021-24959
CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...
POC_CVE-2024-46256
POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the same POC, just change the provider param. Note Sometimes the nc file can't execute on the server or can't execute command! Install require pip install requests Run Exploit python3 POCCVE-2024-46256.py + Target type IP/Host? i/h: i + Enter...
CVE-2023-46818
CVE-2023-46818 Python Exploit π₯ Description This Python exploit script targets a security vulnerability in ISPConfig's records POST parameter to /admin/languageedit.php, which is not properly sanitized. This allows an authenticated admin to inject and execute arbitrary PHP code. β οΈ Affected...
CVE-2023-46818
CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash CVE-2023-46818 Authenticated PHP Code Injection in ISPConfig for more details: advisory CVE-2023-46818 PoC Introduction ISPConfig versions Note: This exploit requires valid ISPConfig admin credentials and will deploy a command web she...
cve-2024-10914
POC - CVE-2024β10914- Command Injection Vulnerability in name parameter for D-Link NAS Overview A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiuseradd of the file...
CVE-2016-10033
CVE-2016-10033 β PHPMailer Remote Code Execution π Description This repository contains a proof-of-concept PoC exploit for CVE-2016-10033 , a vulnerability in PHPMailer versions prior to 5.2.18. The issue occurs when the $additionalparameters argument of PHP's built-in mail function is improperly...
EUVD-2026-94651
The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the βurlβ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...
rails-cve-2017-17917
rails-cve-2017-17917 The project demonstrates the replication of a SQL injection vulnerability in the id parameter, and subsequently provides insights into mitigating and resolving this security issue. https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 Stack : Ruby: 3.2.2 Rails: 7.0....
CVE-2026-94154
The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the βurlβ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...
CVE-2022-44877
Centos Web Panel 7 Unauthenticated Remote Code Execution - CVE-2022-44877 + Centos Web Panel 7 Unauthenticated Remote Code Execution + Centos Web Panel 7 - log β CVE-2022-44877 cat log examplelog β CVE-2022-44877 echo "examplelog $whoami" log β CVE-2022-44877 cat log examplelog examplelog root β...
CVE-2024-3121
CVE-2024-3121 - Remote Code Execution RCE in parisneo/lollms Discovered by: Syed Jan Muhammad Zaidi GitHub: dark-ninja10 CVE ID: CVE-2024-3121 Repository Affected: parisneo/lollms 𧨠Vulnerability Summary A Remote Code Execution RCE vulnerability exists in the createcondaenv function of the lollms...
CVE-2025-4840
CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...