CVE-2026-23491

CVE-2026-23491: InvoicePlane has Unauthenticated Path Traversal in Guest Controller Overview Field| Details ---|--- CVE ID| CVE-2026-23491 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products InvoicePlane/InvoicePlane Details Summary A path traversal...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload. Vulnerability Description A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The...

WordPress-6.9.1-Blind-SSRF

WordPress-6.9.1-Blind-SSRF The exploit has no cve assigned. Affected Versions 6.8 - 6.8.3 6.9 - 6.9.1 WordPress = 6.9.1 - Unauthenticated Blind SSRF via XML-RPC Pingback Discovery proof of concept PoC Usage 1. Install requests if not yet installed pip install requests 2. Change config variables...

CVE-2022-3590-WordPress-Vulnerability-Scanner

CVE-2022-3590 WordPress Vulnerability Scanner This Python script is designed to check whether a WordPress website is vulnerable to the CVE-2022-3590 vulnerability. The vulnerability exploits an unauthenticated blind Server-Side Request Forgery SSRF in the pingback feature of WordPress. Getting...

CVE-2026-54238

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-114611

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with opensslpkcs7verify..., PKCS7NOVERIFY,...

CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE Unauthenticated Remote Code Execution RCE in WPvivid Backup & Migration 800%2C000-brightgreen?style=for-the-badge" alt="Installs" Critical flaw impacting over 800,000–900,000+ WordPress sites Unauthenticated arbitrary PHP upload → full server compromise 🌩️ Overview...

CVE-2025-10351-POC

CVE-2025-10351 POC - SQL Injection Exploit 💉 POC for CVE-2025-10351: An unauthenticated SQL Injection vulnerability that affects a specific endpoint in Melis Platform Framework. 🔗 References 📄 CVE-2025-10351 on MITRE 📄 Melis Platform Warning on INCIBE Spanish National Cybersecurity Institute 🚀...

CVE-2023-1454

CVE-2023-1454 jmreport/qurestSql Unauthorized SQL Injection Batch Scan POC Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest jeecg-boot 3.5.0 has been exposed to multiple SQL injection vulnerabilities. Description Original tool URL The original tool h...

CVE-2025-47812-PoC

CVE-2025-47812 — Wing FTP Server Remote Code Execution RCE Overview Field| Value ---|--- CVE| CVE-2025-47812 Affected| Wing FTP Server 7.4.4 Type| Unauthenticated Remote Code Execution CVSS Score| 10.0 Critical Fixed in| Wing FTP Server 7.4.4 How it works The vulnerability exists in the...

CVE-2026-5027

🔥 CVE-2026-5027 - Langflow Path Traversal Arbitrary File Write to RCE Unauthenticated Remote Code Execution via File Upload -orange?style=for-the-badge 📌 Overview Langflow suffers from a critical path traversal vulnerability in the file upload endpoint POST /api/v2/files. An attacker can send a...

GravCMS_Nmap_Script

GravCMSNmapScript It is a nmap script for GravCMS vulnerability CVE-2021-21425 USAGE -- nmap -p443 --script gravcms.nse -- PORT STATE SERVICE -- 443/tcp open https -- | gravcms: -- | VULNERABLE: -- | GravCMS CVE-2021-21425 -- | State: VULNERABLE Exploitable -- | IDs: CVE:CVE-2021-21425 --...

CVE-2024-55457-PoC

CVE-2024-55457-PoC MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of...

CISCO-CVE-2020-3452-Scanner-Exploiter

CISCO CVE-2020-3452 Scanner & Exploiter It will scan the target servers from shodan and then find the vulnerable servers to CVE-2020-3452 Cisco Adaptive Security Appliance and FTD Unauthorized Remote File Reading. About A vulnerability in the web services interface of Cisco Adaptive Security...

WP-CVE-2023-28121

WP-CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Reff : https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072/...

Exch-CVE-2021-26855_Priv

Exch-CVE-2021-26855 ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability...

CVE-2019-15043

CVE-2019-15043 POC Description Proof of concept scan to check if a Grafana server is vulnerable to CVE-2019-15043. Checks the Grafana server version number and checks to see if the snapshot API allows for unauthenticated requests. CVE-2019-15043 CVE-2019-15043 is a Denial-of-service vulnerability...

react2shell

Description: CVE-2025-55182 is a critical unauthenticated remote code execution RCE vulnerability in the react-server package used by React Server Components RSC. CVE-2025-66478 is the corresponding RCE vulnerability in Next.js, which inherits the same underlying flaw through its implementation o...

checker-cve2020-3452

Checker CVE-2020-3452 This Python script checks whether the target server is vulnerable to CVE-2020-3452. Cisco Adaptive Security Appliance and FTD Unauthorized Remote File Reading A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower...

CVE-2019-0708

CVE-2019-0708 BlueKeep Currently, I public only the exploitation note for Windows 7 x64 only. See NOTE.md Note: Windows 2008 R2 with default configuration fDisableCam=1 can be exploited. Reliability is same as Windows 7. Update July 2020 Add info for Windows Server 2008 to NOTE.md Add PoCs for...