cve-2024-56348

JetBrains TeamCity Authentication Bypass + RCE CVE-2024-56348 PoC 📜 Description CVE-2024-56348 is a critical authentication bypass vulnerability in JetBrains TeamCity on-premises affecting all versions prior to 2024.12. The REST API improperly handles requests to paths containing ;.jsp, allowing ...

CVE-2025-6792

Exploit: Unauthorized Pusher Channel Subscription Eavesdropping 1 Obtain Pusher credentials from browser console console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 Subscribe to a victim’s private channel Pusher Eavesdrop Test Listening on private-user-5...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

CVE-2025-12137

1 Helper to call the plugin’s REST API with current nonce async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method, headers:...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability 1. Vulnerability Description Zoho ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...

Splunk Enterprise 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.4.x prior to 10.4.3. Splunk Enterprise 10.2.x, 10.0.x, and 9.4.x are not affected. It is, therefore, affected by a SQL injection vulnerability as referenced in the SVD-2026-1001 advisory. A user that holds a role with the...

Splunk Enterprise 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.0.x prior to 10.0.10, 10.2.x prior to 10.2.7, or 10.4.x prior to 10.4.3. Splunk Enterprise 9.4.x is not affected. It is, therefore, affected by multiple vulnerabilities as referenced in the SVD-2026-1001 advisory, including: - A...

Splunk Enterprise 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.2.x prior to 10.2.7 or 10.4.x prior to 10.4.3. Splunk Enterprise 9.4.x and 10.0.x are not affected. It is, therefore, affected by a missing authentication vulnerability as referenced in the SVD-2026-1001 advisory. An...

CVE-2025-32429

CVE-2025-32429 XWiki SQL Injection PoC Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 Vulnerability: Blind SQL Injection in XWiki LiveData REST API Affected File: getdeleteddocuments.vm sort parameter Description : A blind SQL Injection vulnerability exists in XWiki Platform’s...

CVE-2025-5964-

CVE‑2025‑5964 Path Traversal PoC for M‑Files Author: Byte Reaper Telegram: @ByteReaper0 Overview This repository contains a Proof‑of‑Concept PoC in C for a suspected Path Traversal vulnerability in M‑Files version 25.6.14925.0. The PoC file exploit.c attempts to read sensitive files e.g...

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

CVE-2019-6340 / SA-CORE-2019-003 Three scripts included to demonstrate how Drupal 8.6.9 is vulnerable to CVE-2019-6340: createnodeviarest.py - Example of normal authenticated node create with REST API doesnotcorrespond.py - Proving the request is processed even without authentication exploit.py -...

CVE-2017-12542-Exploit

HP iLO Authentication Bypass CVE-2017-12542 This repository contains a proof-of-concept exploit for CVE-2017-12542 , an authentication bypass vulnerability affecting certain versions of HP Integrated Lights-Out iLO firmware. The vulnerability allows unauthenticated access to the iLO REST API, whi...

wp-mhn

wp-mhn Integra tu Servidor Modern Honeypot Network y tu Blog de Wordpress mediante la API REST de MHN y los shortcodes de WP. Instalación y uso 1. Descarga wp-mhn como un archivo zip, o clona el repositorio y comprímelo. 2. Edita config.sample.php con la información correspondiente a tu servidor...

CVE-2025-24000-exploit

CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Overview This script exploits CVE-2025-24000 , a high-severity broken access control vulnerability in the Post SMTP WordPress plugin versions ≤ 3.2.0. It allows any authenticated user with a low-privilege account e.g. Subscriber to access th...

CVE-2026-104076

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...

CVE-2026-104076

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 are vulnerable to a missing authentication flaw in their REST API endpoints on port 8288 . Remote unauthenticated attackers can exploit this to read sensitive device information, including network configurations and fir...

CVE-2026-104076 TVU Networks Receiver/Transceiver Missing Authentication via REST API

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...

EUVD-2026-95251

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers...

GHSA-9FFP-22J7-56R2 JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

Summary Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window. For...

CVE-2026-107586

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...