CVE-2026-107585

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-25632

CVE-2026-25632 — JSON Deserialization RCE in REST API Bugfix Challenge Inspired by a real 2026 vulnerability CVSS 10.0, actively exploited Based on: CVE-2026-25632 — Remote Code Execution via unsafe type-driven JSON deserialization discovered in the EPyT-Flow water-network simulation REST API and...

sxwp2shell

/ / / / / / | |/ / \ / / / / / / / / | / / / / / / / // / / / / / // | //// ///// /////|| sxwp2shell — Pre-auth RCE exploit for WordPress via REST API batch-route confusion CVE-2026-63030 + SQL injection CVE-2026-60137. Affected: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Install git clone...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...

CVE-2024-3605

CVE-2024-3605 WP Hotel Booking = 2.1.0 - Unauthenticated SQL Injection Description The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'roomtype' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to...

CVE-2026-107586

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

EUVD-2026-95038

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

CVE-2026-107586

Progressive Robot hMailServer versions 6.2.28 through 6.3.5 are vulnerable to an uncontrolled eviction in the REST API's browser session table. Because the table is shared across all accounts and lacks a per-account session limit, a remote authenticated user can intentionally fill the table by re...

CVE-2026-107586 Allocation of Resources Without Limits or Throttling in hMailServer

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

CVE-2026-107586 Allocation of Resources Without Limits or Throttling in hMailServer

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

CVE-2026-107585

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-107585 Allocation of Resources Without Limits or Throttling in hMailServer

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-107585

Progressive Robot hMailServer versions 6.3.4 and 6.3.5 are vulnerable to an uncontrolled eviction issue in the REST API pending sign-in tables. Because the routes for single sign-on (OpenID Connect, SAML) and passkey challenges are accessible without authentication, an unauthenticated remote atta...

CVE-2026-107585 Allocation of Resources Without Limits or Throttling in hMailServer

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

EUVD-2026-95037

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2024-11972-PoC

CVE-2024-11972-PoC Hunk Companion 1.9.0 - Unauthenticated Plugin Installation Description The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin befo...

CVE-2026-14281

CVE-2026-14281 — WAWP Automation Web Platform Unauthenticated Privilege Escalation Python 3 PoC for CVE-2026-14281 in the WordPress plugin Automation Web Platform automation-web-platform — WAWP / Notifications & OTP for WooCommerce. PoCbit Listed on PoCbit — community catalog:...

reburp

reburp Burp's API/MCP is LIMITED - reburp is a Burp Suite extension that exposes the full Montoya API as a locally served openapi REST API, optimized for your AI agents. Issues | Discussions What is reburp reburp turns Burp Suite into something you can script. It loads as a Java extension and...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass Exploit Python 2.7 exploit for the Burst Statistics plugin vulnerability CVE-2026-8181 that allows unauthenticated attackers to bypass REST API authentication, retrieve application passwords, and create new administrator users on vulnerable...