2319 matches found
PT-2026-58869
Name of the Vulnerable Software and Affected Versions Grav Flex Objects Plugin versions prior to 1.4.3 Description An issue exists where the requireFlexPermission function in classes/Api/FlexApiController.php fails to deny access when a directory blueprint omits config.admin.permissions. This...
PT-2026-58870
Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The Grav Login plugin allows a top-level GET request to be sent to the task URI parameter via the TaskServiceProvider without requiring a login-form nonce, an Origin check, or a Referer...
Exploit for Improper Authentication in Cisco Catalyst_Sd-Wan_Manager
Executive Summary The CVE-2026-20127 Defensive Companion is a...
MAL-2026-10136 Malicious code in transform-es2015-sticky-regex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eadf76ef8e123f9ce50c2910c71912996a3d079a91076ffed8d29830a1687ae1 package.json declares both a dependency and a devDependency on 'transform-es2015-sticky-regex' pointing at...
Malicious code in transform-es2015-sticky-regex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eadf76ef8e123f9ce50c2910c71912996a3d079a91076ffed8d29830a1687ae1 package.json declares both a dependency and a devDependency on 'transform-es2015-sticky-regex' pointing at...
security-research
security-research Personal CVE PoC repository — exploit scrip...
PT-2026-55983
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...
cve-pocs
CVE Proof-of-Concept Collection !GitHub starshttps://img...
Exploit for CVE-2026-43503
DirtyClone DirtyClone is a C-based local privilege escalation...
PT-2026-53227
Name of the Vulnerable Software and Affected Versions WsgiDAV versions prior to 4.3.5 Description The sample MySQLBrowserProvider in wsgidav/samples/mysql dav provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. This occurs within the exists record by...
Exploit for CVE-2026-46331
cve-id ⚡ Simple Usage Use this project only in safe and...
Exploit for Path Traversal in Rarlab Winrar
Amaranth Project A multi-stage backdoor implantation attack c...
Exploit for Code Injection in Lantronix Eds5032_Firmware
cve-id ⚡ Simple Usage Use this project only in safe and...
Exploit for CVE-2026-8461
cve-id ⚡ Simple Usage Use this project only in safe and...
MCATester
MCATester — AI-Powered OSINT & Vulnerability Discovery Platfor...
PT-2026-51818
Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Envoy versions prior to 1.36.7 Envoy versions prior to 1.37.3 Envoy versions prior to 1.38.1 Description Envoy can translate a downstream HTTP/3 request that is complete at the transport layer but contains a...
Exploit for CVE-2026-42055
cve-id ⚡ Simple Usage Use this project only in safe and...
Exploit for CVE-2026-48907
CVE-2026-48907 TODO - Init own cve ⚡ Simple Usage U...