CVE-2019-19781

CVE-2019-19781 CVE-2019-19781 Module for Router Scan Project How To Use prepare pip3 install ipcalc,requests usage python3 scanner.py Copyright some part of this repository that send tcp response is partly forked from trustedsec/cve-2019-19781 with some changes for APIs of Router Scan Project...

CVE-2018-13379

CVE-2018-13379 CVE-2018-13379 Module for Router Scan Project How To Use prepare pip3 install time,threading,ipcalc,requests usage python3 exp.py -f list.txt Copyright some part of this repository that send tcp response is partly forked from milo2012/CVE-2018-13379 with some changes for APIs of...

CVE-2024-27348

🔥 CVE-2024-27348 Exploitation Toolkit 🎓 Academic Project 📚 Course: FC411 - Secure Network Design 👨‍🏫 Instructor: Dr. Maira Sultan 🏫 University: University of Prince Mugrin 📅 Year: 2025 ⚡ A complete toolkit for exploiting CVE-2024-27348 Apache Huge-Graph-Server developed as part of the FC411 course...

CVE-2018-8353-POC

CVE-2018-8353 POC Simple poc of CVE-2018-8353 Microsoft Scripting Engine Use After Free saurce : https://bugs.chromium.org/p/project-zero/issues/detail?id=1506...

CVE-2019-2215

CVE-2019-2215 Copy and pasted from: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ https://github.com/grant-h/qu1ckr00t/blob/master/native/poc.c...

ROOT-APP-NPM-CVE-2025-64718 CVE-2025-64718 in js-yaml - Patched by Root

Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available...

goIssue_kirkstone

OpenEmbedded-Core OpenEmbedded-Core is a layer containing the core metadata for current versions of OpenEmbedded. It is distro-less can build a functional image with DISTRO = "nodistro" and contains only emulated machine support. For information about OpenEmbedded, see the OpenEmbedded website:...

goIssue_dunfell

OpenEmbedded-Core OpenEmbedded-Core is a layer containing the core metadata for current versions of OpenEmbedded. It is distro-less can build a functional image with DISTRO = "nodistro" and contains only emulated machine support. For information about OpenEmbedded, see the OpenEmbedded website:...

CVE-2021-44228-Demo

CVE-2021-44228-Demo This project for prove and testing zero-day log4j exploit verify dependency ./mvnw dependency:list patch A set ENV LOG4JFORMATMSGNOLOOKUPS=true B add vm option -Dlog4j2.formatMsgNoLookups=true C.1 add properties log4j2.formatMsgNoLookups=true NOT WORK C.2 add properties...

CVE-2026-66082

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an authorization bypass (CWE-863) that allows authenticated users to perform unauthorized operations on workflow schedules, definitions, and task instances in other projects. The root cause is that affected endpoints verify permissio...

CVE-2026-66082 Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...

keyguard

keyguard Scan codebases, GCP projects, and CI pipelines for exposed Google API credentials — before they get exploited. The problem: Google retroactively enabled Gemini API access on existing API keys Maps, Places, etc. that were designed to be public and embedded in client-side code. When someon...

PT-2026-108115

In OpenStack Mistral through 23.0.0, the std.ssh proxied action passes a caller-supplied proxy command value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...

GHSA-4HMC-CFM3-W43C Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...

EUVD-2026-94614

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

CVE-2026-104953

The MPG WordPress plugin (versions before 4.2.3 ) is vulnerable to SQL injection due to improper validation of imported project data before it is used in database queries. This flaw allows users with Editor privileges or higher to execute malicious queries and access sensitive information, such a...

CVE-2026-103871

A flaw was found in pulp-python's PyPI simple index. Project names are written into the HTML index without escaping. A user who can publish a Python package can store markup in the package name. A person who opens that index in a browser runs the markup in the origin that served the page, and the...

GLPI <=10.0.2 - Remote Command Execution

GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...