Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

Dify v1.9.1 - Broken Access Control

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. id: CVE-2025-63387 info: name: Dify v1.9.1 - Broken Access Control author:...

CVE-2023-46974

CVE-2023-46974 POC Description Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

CVE-2024-50945

CVE-2024-50945 Description SimplCommerce is affected by a Broken Access Control vulnerability in the review system, allowing unauthorized users to post reviews for products they have not purchased. Detection Method An attacker can detect this vulnerability by sending a request to the review...

CVE-2017-11610

CVE-2017-11610 Unauthenticated Reverse Shell RCE for Supervisor 3.0a1 - 3.3.2 Standalone Python ≥3.6 Unauthenticated RCE exploit for Supervisor 3.0a1 to 3.3.2, rewritten from this Metasploit module. Explanatory post here. Tested with Python 3.7 on this target runing Supervisor 3.3.2 Usage:...

EUVD-2026-97140

In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges...

Electrolink-FM-DAB-TV

Electrolink-FM-DAB-TV For CVE-2025-51040 Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 Description Electrolink FM/DAB/TV Transmitter web management...

CVE-2024-10605

Affected Version: BloodBank Management System : 1.0 Vulnerability Information: Vulnerability Type: Cross Site Request Forgery CSRF Severity: HIGH Status: Unpatched Vulnerable Endpoint: Path: file/request.php Vulnerability Description: There is a Cross Site Request Forgery on this endpoint...

CVE-2026-50656-rogueplanet-validation

RoguePlanet PoC Validation Report for Microsoft Defender Purpose and scope of the report This report concerns the validation of the publicly described RoguePlanet PoC related to Microsoft Defender. The described technique was presented in the media on 10 June 2026 as a Local Privilege Escalation...

CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

Dell System Update < 2.3.0.0 Multiple Vulnerabilities (DSA-2026-324)

According to its self-reported version, the Dell System Update DSU installation on the remote host is prior to 2.3.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-324 advisory. - Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitati...

Pizzafy 1.0 Shell Upload / SQL Injection

Pizzafy version 1.0 suffers from remote shell upload and remote SQL injection vulnerabilities. Title: pizzafy-1.0-Multiple-SQLi&FU-shell-vulnerabiliries+Exploit Author: nu11secur1ty Date: 10/12/2026 Vendor: https://github.com/clararod9 Software:...

UBUNTU-CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

PT-2026-110910

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed...

PT-2026-110563

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

PT-2026-111002

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with...

CVE-2025-48593

CVE-2025-48593: Zero-Click Remote Code Execution in Android System Author: LAKSHMIKANTHAN K letchupkt Date: November 2025 Severity: Critical A critical zero-click remote code execution vulnerability affecting Android 13-16 devices. Vulnerability Overview Attribute| Details ---|--- CVE ID|...

CVE-2021-46070

CVE-2021-46070 Exploit Title: Vehicle Service Management System - 'Service Requests' Stored Cross Site Scripting XSS Exploit Author: SANU P.L CVE: CVE-2021-46070 CVSS: 4.8 MEDIUM References: https://www.plsanu.com/vehicle-service-management-system-service-requests-stored-cross-site-scripting-xss...

CVE-2026-95702

A flaw was found in Google gVisor's Virtual File System VFS. A local attacker with standard container privileges can exploit this vulnerability to achieve arbitrary code execution within the host sentry process. By improperly releasing a backing memory file multiple times from an in-sandbox overl...

CVE-2026-7791

CVE-2026-7791 PoC: Privileged by Default Research proof-of-concept for local privilege escalation in Amazon WorkSpaces TOCTOU + SYSTEM-level arbitrary file write in the Skylight Workspace Config Service. Full technical details: Cymulate blog | ---|--- CVE| CVE-2026-7791 Vendor| AWS Security...