PT-2025-50136

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Message parameter of the ''/Mobile/Compose.aspx'' API endpoint. The Message value is not proper...

PT-2025-50232

Name of the Vulnerable Software and Affected Versions OpenBMCS version 2.4 Description OpenBMCS version 2.4 contains a Cross-Site Request Forgery CSRF issue. An attacker can perform actions with administrative privileges by exploiting the sendFeedback.php API endpoint. Attackers can submit...

CVE-2025-61075

Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to carry out administrative functions and manipulate data of other users via unauthorized API calls...

Adata Mitarbeiter Portal security vulnerabilities

adata Mitarbeiter Portal is an employee self-service and human resource management platform from adata Germany. A security vulnerability exists in adata Mitarbeiter Portal version 2.15.2.0, which stems from improper access control and could lead to the execution of administrative functions and...

WordPress plugin Auto Alt Text has a cross-site request forgeing vulnerability

WordPress Auto Alt Text plugin is a tool that uses artificial intelligence technology to automatically generate alternative text AltText for website images. The WordPress Auto Alt Text plugin suffers from a cross-site request forgery vulnerability, which arises from a web application that does no...

Mercury MR816v2 security vulnerabilities

The Mercury MR816v2 is an access control device from Mercury China. A security vulnerability exists in Mercury MR816v2 081C3114 version 4.8.7 Build 110427 Rel 36550n, which originates from stored cross-site scripting and could lead to the disclosure of an administrator's session and the execution...

PT-2025-50145

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS issue in the theme parameter of the ''/Mondo/lang/sys/Forms/Statistics.aspx'' endpoint. The theme value is not...

PT-2025-50137

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS issue in the AddressesBcc parameter of the ''/Mondo/lang/sys/Forms/AddressBook.aspx'' endpoint. The AddressesBcc val...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Next.js RCE Exploit Tool 中文文档./README.zh-CN...

Exploit for Deserialization of Untrusted Data in Facebook React

🧨 React2Hell — CVE-2025-55182 Exploit 🔥 Next.js / React...

Exploit for CVE-2025-66478

CVE-2025-66478 – Next.js Server Actions RCE Vulnerability: Ana...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Scanner A comprehensive vulnera...

CVE-2025-66581

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because the affected endpoints...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell R2S - CVE-2025-55182 Testing Tool !R2S Banne...

CVE-2024-9183

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific...

Exploit for Deserialization of Untrusted Data in Facebook React

Vulnerable Next.js RSC Application - CVE-2025-55182 ⚠️ WARN...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Vulnerability Exploitation Tool Rust Version...

Exploit for CVE-2025-66478

Next.js CVE-2025-66478 PoC English | 한...

CVE-2025-10055

The Time Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on several endpoints. This makes it possible for unauthenticated attackers to perform a variety of actions via a forge...

CVE-2025-34263

CVE-2025-34263 : Advantech WISE-DeviceOn Server versions prior to 5.4 suffer an authenticated stored XSS in the /rmm/v1/plugin-config/dashboards/menus endpoint. When a user adds/edits a dashboard entry, the label and path are stored in plugin configuration data and rendered in the dashboard UI wi...