CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...

CVE-2013-10039

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ipcheckhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deploymen...

CVE-2013-10039

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ipcheckhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deploymen...

CVE-2025-52203

Summary: CVE-2025-52203 affects DevaslanPHP project-management v1.2.4 with a stored XSS in the Ticket Name field. An authenticated attacker can inject JavaScript, which is stored in the database and executes in a user’s browser context when they log in and are redirected to the Dashboard. The iss...

Dictionary-Of-Pentesting

This repository is an offensive tool for bug bounty hunting and penetration testing, specifically a dictionary collection project for various types of attacks, including Pentesing, Fuzzing, Bruteforce, and BugBounty. The primary target product/service is not explicitly stated, but the repository...

CVE-2025-45406

CodeIgniter4 v4.6.0 is affected by a stored XSS vulnerability in the debugbar_time parameter. The issue is described as enabling arbitrary web scripts or HTML, with a note that the supplier disputes exploitability since the value of debugbar_time may not be controllable and data is escaped by the...

PT-2025-31210 · Undefined · Undefined

A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the use...

Exploit for CVE-2025-1302

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: po...

RHSA-2024:6837

creationtimestamp| type| source ---|---|--- 2025-07-24 13:36:18+00:00| seen| Telegram/NbE6uJrtwbDK9IW7nliDHdxLxWoJGtWow9EEsvdw7FPY0WQ 2025-08-30 22:20:46+00:00| seen| Telegram/jN3p0rCho2cvLYsHTHnhIMlK4AolhcCwlVRO9wRJlqHX1Xk...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

wildfly: Wildfly vulnerable to Cross-Site Scripting (XSS)

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

CVE-2025-51862

TelegAI (telegai.com) is affected by an Insecure Direct Object Reference (IDOR) vulnerability in its chat component. Exploitation relies on manipulating the profile_id in chat-related API calls (as evidenced by the GitHub exploit, PT-2025-30420 description, and other reports), enabling an attacke...

Chaindesk Cross Site Scripting

Chaindesk, a web application for constructing AI Agents, is vulnerable to a persistent cross site scripting vulnerability in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the underlying Large Language...

CVE-2025-51400

CVE-2025-51400 is a stored XSS in Live Helper Chat’s Personal Canned Messages. Affected versions include 4.60 (and 4.61 per sources). Root cause is insufficient input validation/storage of crafted payloads in the Personal Canned Messages, enabling arbitrary JavaScript execution when an admin/oper...

Exploit for CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web...

Exploit for CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web...

Exploit for CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a w...

Exploit for SQL Injection in Anisha Online_Appointment_Booking_System

🚨 CVE-2025-7753 — SQL Injection PoC Exploit Author: Byte...

Insufficiently Protected Credentials

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the invite mechanism for remote clusters. An attacker can send unauthorized synchronization payloads by...