CVE-2025-38561

CVE-2025-38561 ksmbd: PreauhHashValue race condition If client send multiple session setup requests to ksmbd, PreauhHashValue race condition could happen...

CVE-2026-37196

CVE-2026-37196 – Stored Cross-Site Scripting XSS in nirix traq v3.9.0 Overview A Stored Cross-Site Scripting XSS vulnerability exists in nirix traq v3.9.0 , where user-supplied input in the ticket description field is improperly sanitized before being rendered in the application interface. This...

CVE-2025-54309__Enhanced_exploit

CVE-2025-54309Enhancedexploit This is a enhanced version of the exploit POC originally created by watchtowrlabs : https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309 massive shoutout to them!! This exploit is meant for research and education purposes and th...

Gogs_RCE

GogsRCE Vulnerability Reproduction 0x01 Register a Regular Account on the Frontend 0x02 Compile a Forged Admin Session Using Go go run main.go package main import "bytes" "encoding/gob" "encoding/hex" "fmt" "io/ioutil" func EncodeGobobj mapinterfaceinterface byte, error for , v := range obj...

CVE-2024-57522

CVE-2024-57522 - Stored XSS Vulnerability in Users.php - SourceCodester Packers and Movers Management System 1.0 Description This repository contains a Proof of Concept PoC for a Stored Cross-Site Scripting XSS vulnerability in the Packers and Movers Management System 1.0 by SourceCodester. The...

CVE-2023-31853

CVE-2023-31853 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/bandwidth has reflected XSS via the icon parameter. The methods of exploitation would involve sending a specially crafted request to the victim tha...

CVE-2022-3949

CVE-2022-3949 XSS in Simple Cashiering System Simple Cashiering System is vulnerable to Cross Site Scripting XSS - a malicious actor can change the fullname of a compromised user to a XSS Payload and whenever a admin visits the user-tab or the sales tab and looks into sales made by the malicious...

Termix-research

Termix Security Research Vulnerability research on Termix, a web-based SSH and server management platform 13k+ stars. CVE| Issue| Severity| Fixed| Advisory ---|---|---|---|--- CVE-2026-45746| Session hijacking → RCE| 9.0 Critical| v2.3.2| GHSA-cx2r-843c-vww8 CVE-2026-45750| OS command injection|...

LockBit-Ransomware-Analysis

🔐 LockBit Ransomware Analysis – Citrix Bleed Exploitation 📌 Overview This project presents a detailed threat intelligence and incident response analysis of the October 2023 LockBit ransomware attack targeting Boeing. The attackers exploited CVE-2023-4966 Citrix Bleed to hijack NetScaler session...

CVE-2025-24813

CVE-2025-24813 Tomcat PoC PoC for an authorized CTF/lab environment. It exploits CVE-2025-24813 via partial PUT write of a Tomcat session file, then triggers deserialization with JSESSIONID. Prerequisites Python 3 Python requests module Java JDK java and javac The included...

Exploit-CSRF-on-SCOPIA-XT-Desktop-version-8.3.915.4

Exploit CSRF on SCOPIA XT Desktop version 8.3.915.4 This PoC will be describe how to explore Cross-Site Request CSRF Forgery on SCOPIA XT Desktop version 8.3.915.4 About SCOPIA website: https://support.avaya.com/products/P1421/scopia-desktop/8.2.1 About Cross-Site Request Forgery CSRF Cross-site...

CVE-2025-12135

WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; Code execution from /core/shortcodes/class-wpbookit-shortcode-abstract.php:20-27: $wpbcustomcode= getoption 'wpbcustomcodedata', 'csscode' = '', 'jscode' = ...

CVE-2026-76581-Detector

CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581. The detector does not exploit the authentication bypass, request or replay HMAC values, or create ...

CVE-2021-43857

CVE-2021-43857 CVE-2021-43857 Gerapy command execution Disclaimer This script is for learning and reference only. Do not maliciously attack other people's websites. If you violate laws or regulations, all consequences shall be borne by the user. Technology is innocent and has nothing to do with t...

CVE-2025-23419

🔐 TLS Session Reuse Exploit Tester $ BY XIT A Python-based tool to test potential TLS session reuse vulnerabilities that may allow authentication bypass in misconfigured servers. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Do NOT use it on systems...

CVE-2025-4162026

Security Advisory: CVE-2025-4162026 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

EUVD-2026-109300

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...

CVE-2026-115933

The Postiz application is vulnerable to a critical flaw where it signs session, invitation, and password reset tokens using a single shared secret without specifying the token's purpose. A specific route refreshing browser-extension channel credentials allows users to submit signed data from a re...

CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...

CVE-2021-40903

Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass CVE: CVE-2021-40903 Date: 09/06/2021 Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22 Exploit Author: CQR.company / Vulnz. Vendor Homepage: https://github.com/anselal/antminer-monitor,...