CVE-2019-10475

CVE-2019-10475 Quick POC for Jenkins CVE-2019-10475 / SECURITY-1490 reported on 2019-10-23. The issue is within the build-metrics plugin which generates some basic build metrics. It's commonly used with the Jenkins sidebar links plugin. This is a simple & generic reflected XSS vulnerability. The...

CVE-2025-30208

CVE-2025-30208 Detection Tool Vulnerability Analysis Vite Arbitrary File Read Vulnerability Analysis and Reproduction CVE-2025-30208 Introduction This tool is used to detect whether a target system is vulnerable to CVE-2025-30208. This vulnerability allows an attacker to read sensitive files such...

CVE-2025-49132

CVE-2025-49132 Proof of Concept PoC This repository contains a Proof of Concept PoC for CVE-2025-49132, a critical unauthenticated remote code execution RCE vulnerability in Pterodactyl Panel versions prior to 1.11.11. Vulnerability Details CVE ID : CVE-2025-49132 Severity : 10.0 Critical -...

OpenSource-ERP-SQL-Injection

OpenSource-ERP-SQL-Injection La aplicación OpenSource ERP tiene una vulnerabilidad de inyección SQL. CVE-2019-5893 https://vulners.com/cve/CVE-2019-5893 https://www.exploit-db.com/exploits/46118 PoC - Obtener nombre de la BD POST /db/utils/query/data.xml HTTP/1.1 User-Agent: Mozilla/5.0 Windows N...

BIT-ENVOY-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — Hikvision IP Camera / DVR / NVR Improper Authentication — Privilege Escalation via Crafted Query Parameter | ---|--- CVE ID| CVE-2017-7921 Vulnerability Class| CWE-287: Improper Authentication CVSS v3.0 Base Score| 10.0 Critical — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v2.0 Scor...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 allows SQL Injection Suggested description : "ISIDA RETRIEVER v5.2" SQL Injection Vulnerable functionality : ISIDA RETRIEVER Platform is vulnerable to SQL Injection Vulnerable URL and paramert : website.com/index.php?title=Injection Vulnerable URL and parame...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injection Unauthenticated JSON/NoSQL operator injection in Budibase. Any anonymous visitor of a published Budibase app that exposes a PUBLIC query backed by a document datasource MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST wi...

CVE-2026-100753

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100753

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...

CVE-2021-40438

CVE-2021-40438 exploit PoC with Docker setup CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-40438:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Note: You can also use Image ID...

CVE-2026-100753: Improper Neutralization of Input During Web Page Generation

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment...

cve-2023-5044

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is a quick Go program to exploit the recent CVE in the Ingress Nginx controller. Details on how to do this are already out there via Rory McCune's blog at https://raesene.github.io/blog/2023/10/29/exploiting-CVE-2023-5044/, this just...

CVE-2026-44262

dedoc/scramble RCE CVE-2026-44262 PoC 📜 Description CVE-2026-44262 is an unauthenticated Remote Code Execution vulnerability in dedoc/scramble, a Laravel API documentation generator. NodeRulesEvaluator::doEvaluateExpression calls extract$variables before eval"return $code;". When a controller...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2018-6643

CVE-2018-6643 CVE-2018-6643 Infoblox NetMRI 7.1.1 hxxp::/xxx.abc/api/docs/index.php?query=555"...

CVE-2022-23305_POC

CVE-2022-23305 Log4j JDBCAppender sql injection POC This is a very simple Spring Boot based application that demonstrates the CVE-2022-23305 vulnerability. It uses Apache Maven, Spring Boot, Spring MVC, and the H2 in-memory database to log one simple entry, taken as a URL query string parameter...

CVE-2026-100391

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...