CVE-2021-38647

CVE-2021-38647 CVE-2021-38647 - POC pour exploiter une RCE non authentifiée OMIGOD sur les VM UNIX/Linux Azure ! Détails Dans Microsoft Azure, l'application OMI est installée automatiquement lorsque des services comme Azure Automation Accounts, Update Management, Log Analytics, Configuration...

CVE-2023-5204

CVE-2023-5204 AI ChatBot = 5.0.12 AND time-based blind query SLEEP Payload: action=wpbosearchresponse&name=test&keyword=test&strid=1 AND SELECT 1436 FROM SELECTSLEEP5kZil Type: UNION query Title:...

CVE-2025-7340

🚨 HT Contact Form Widget = 2.2.1 - Неаутентифицированная загрузка произвольных файлов CVE-2025-7340 CVE: CVE-2025-7340 CVSS: 9.8 Критический 📝 Описание Плагин HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder для WordPress уязвим к произвольной загрузке файлов...

CVE-2025-8723

⚡️ Cloudflare Image Resizing Описание: Конечная точка REST API плагина не проверяет аутентификацию пользователя и некорректно санирует ввод в методе hookrestpredispatch. Этот недостаток позволяет злоумышленникам внедрять и выполнять произвольный PHP-код, отправляя вредоносные запросы — без...

CVE-2022-36553-PoC

CVE-2022-36553 - Hytec Inter HWL-2511-SS Unauthenticated Remote Command Injection. Overview This repository contains a Proof of Concept PoC reverse shell script for exploiting CVE-2022-36553, a critical vulnerability in Hytec Inter HWL-2511-SS devices. The script is a practical demonstration,...

CVE-2020-13937

Description Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information...

CVE-2025-67888

CVE-2025-67888 Control Web Panel = 0.9.8.1208 admin/index.php OS Command Injection Vulnerability Affected Versions: Version 0.9.8.1208 and prior versions. Vulnerability Description: User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application Это уязвимое приложение для тестирования эксплойта для обхода аутентификации Really Simple Security 9.1.2 CVE-2024-10924. ПРЕДУПРЕЖДЕНИЕ! Это приложение содержит серьезные уязвимости безопасности. Запускайте его на свой страх и...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application This is a vulnerable application to test the exploit for the Really Simple Security 9.1.2 authentication bypass CVE-2024-10924. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is...

CVE-2025-0282

PoC для CVE-2025-0282 Удаленное неаутентифицированное переполнение буфера на основе стека, затрагивающее Ivanti Connect Secure, Ivanti Policy Secure и Ivanti Neurons for ZTA gateways Обзор Это эксплойт proof of concept для демонстрации эксплуатации CVE-2025-0282, основанный на стратегии...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Head...

CVE-2026-78074

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-51680

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51674

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51677

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...