CVE-2025-3248

POC - Remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code - CVE-2025-3248 Overview Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP request...

CVE-2023-33768

CVE-2023-33768 Description Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service DoS via a crafted firmware file. Additional Information When updating the firmware of the Wemo...

CVE-2019-13288-POC

CVE-2019-13288-POC xpdf/install/bin/pdftotext ./poc.pdf In Xpdf 4.01.01, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646...

CVE-2023-50132

CVE-2023-50132 Suggested description Sourcecodester School Visitor Log e-book v1.0 is vulnerable to Cross Site Scripting XSS. Additional Information youtube link: https://youtu.be/W7Oen8rs64 Vulnerability Type Cross Site Scripting XSS Vendor of Product https://www.sourcecodester.com/ Affected...

CVE-2024-24919-POC

CVE-2024-24919-POC Read about it - https://nvd.nist.gov/vuln/detail/CVE-2024-24919 The vulnerability allows an unauthenticated remote attacker to read the contents of an arbitrary file located on the affected appliance. Nuclei Template:...

CVE-2020-16270

CVE-2020-16270 Suggested description : OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s...

CVE-2025-26206

CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 -critical.svg -blue.svg A critical Cross-Site Request Forgery CSRF vulnerability in Selldone Storefront v1.0 allows remote attackers to escalate privileges by tricking authenticated users into executing state-changing...

CVE-2021-32156

..| CSRF to RCE CRON |.. Description : Exploiting a Cross-site request forgery CSRF attack to get a Remote Command Execution RCE through the Webmin's Scheduled Cron Jobs feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Remote Command Execution...

CVE-2021-31761

..| CVE-2021-31761 |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Remote Command Execution RCE through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Remote Command Execution...

CVE-2021-32162

..| CSRFtoCommandInjection2 |.. Description : Exploiting a Cross-site request forgery CSRF attack to get a Command Injection through the Webmin's File Manager feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's C0de POC...

CVE-2023-47459

CVE-2023-47459 Description A vulnerability was discovered in Knovos Discovery v.22.67.0 that allows a remote attacker to access confidential information using the components: /DiscoveryReview/Service/CaseManagement.svc/GetProductSiteName,...

OpenSSH-CVE-2024-6387-Fix

CVE-2024-6387 OpenSSH Vulnerability Mitigation Script Overview This Bash script is designed to help mitigate the CVE-2024-6387 vulnerability in OpenSSH. The vulnerability affects certain versions of OpenSSH and can potentially allow remote unauthenticated attackers to execute arbitrary code on yo...

CVE-2023-2594

CVE-2023-2594 https://vulners.com/cve/CVE-2023-2594 A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. ...

CVE-2025-25617

CVE-2025-25617 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to create syllabus entries — a role intended only for administrators. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint:...

CVE-2023-33768

CVE-2023-33768 Description Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service DoS via a crafted firmware file. Additional Information When updating the firmware of the Wemo...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 Bomb PoC Proof-of-concept exploit for CVE-2026-49975, a remote denial-of-service vulnerability in HTTP/2 server implementations. Discovered by Quang Luong Calif Security Research, disclosed June 2, 2026. For authorized security testing only. Do not use against infrastructu...

CVE-2020-10129

CVE-2020-10129 - SearchBlox product before V-9.2 is vulnerable to Privileged Escalation-Lower user is able to access Admin Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure...

CVE-2024-27686

MikroTik RouterOS Denial of Service Vulnerability 📌 Description This document describes a Denial of Service DoS vulnerability found in certain versions of MikroTik RouterOS. The vulnerability is due to insufficient handling of crafted SMB requests. A remote attacker could exploit this issue by...

CVE-2026-119619

A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqliquery of the file admin/savestudent.php. Performing a manipulation of the argument date/department/subject/forwardedto/actiontakenby/section/password...

CVE-2026-119619

The cak-filemanagement-system (up to version 5e6433246475e66462e1fea980688de96a049297) is vulnerable to a SQL injection via the mysqli_query function in the admin/save_student.php file. An attacker can remotely trigger this vulnerability by manipulating the date, department, subject, forwarded_to...