CVE-2026-19745

Introduction Hi everyone, back in May I found decent vulnerablities in my router, today I can finally show everyone! Both vulnerablities in this repo are authenticated Denial of Service vulnerablities! I do not know the exact techial details of how or why these vulnerablities work, we never got a...

cve-2025-32463

cve-2025-32463 chroot sudo chroot Execute the command in the selected dir name. Principle This issue was introduced in sudo v1.9.14, which upgraded the matching handling code when the chroot feature is used. This new change modifies the root directory id before matching execution of the chroot...

jbl-wave-buds2-firmware-research

JBL Wave Buds 2 — firmware & OTA reverse engineering Reverse-engineering notes and reproducible tooling for the JBL Wave Buds 2 Bestechnic BES1306 , PID 2100: the on-flash layout, the OTA container format down to the byte, the BLE/GATT command protocol and the BES "TOTA v2" encrypted transport, t...

CVE-2026-116063

A code injection vulnerability exists in DedeCMS versions up to 5.7.118 . The flaw is located in the require_once function of the dede/update_guide.php file, where manipulation of the vtime argument allows for code injection. This vulnerability enables remote exploitation , and public exploit cod...

EUVD-2026-109566

A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function requireonce of the file dede/updateguide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could...

CVE-2026-116063 DedeCMS update_guide.php require_once code injection

A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function requireonce of the file dede/updateguide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could...

CVE-2026-116063 DedeCMS update_guide.php require_once code injection

A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function requireonce of the file dede/updateguide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could...

get-pixels-updated

This is an updated version of get-pixels which patches the CVE-2020-8175 security issue. At the time of creation, every file is the same as the ones from the original repository, excluding the package.json. get-pixels-updated The following is from the get-pixels GitHub page. As mentioned before,...

CVE-2026-60137_CVE-2026-63030

CVE-2026-60137 + CVE-2026-63030 — WordPress Unauthenticated RCE Vulnerability: REST Batch Route Confusion + WPQuery SQL Injection → Full RCE CVSS v3.1: 10.0 / 10.0 — CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 | Patched: 6.9.5, 7.0.2 Zero credential...

CVE-2023-36643

== Affected Software %hardbreaks Vendor: ITB-GmbH Affected Products: TradePro v9.5 Component: Function Customer; Action oordershow Confirmed: yes == Attack Vector %hardbreaks Type: Incorrect Access Control Access-Type: Remote Impact: Information Disclosure Incorrect Access Control in function...

CVE-2025-6586

Download Plugin 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu 1500 qdisc...

CVE-2016-4117-Report

Vulnerability Report for CVE-2016-4117 CVE-2016-4117 CVSS Scores & Vulnerability Types Type| Value ---|--- CVSS Score| 10.0 Confidentiality Impact| Complete There is total information disclosure, resulting in all system files being revealed. Integrity Impact| Complete There is a total compromise ...

Security Bulletin: IBM Db2 Bridge is vulnerable due to Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose

Summary Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5.2 and new Fix pack was release to address the issue...

Exploit for CVE-2026-111497

CVE-2026-111497 Node2Shell/HTTP2Shell - Validation Suite Th...

CVE-2023-6401

CVE-2023-6401 · DLL Hijacking Proof-of-Concept English | 中文 中文 ⚠️ 重要聲明：僅供安全研究和教育目的使用 NotePad++ ≤ 8.1 DLL劫持漏洞的概念驗證。通過在應用程式目錄放置惡意 dbghelp.dll 來執行任意程式碼。 快速開始 下載專案 git clone https://github.com/mekitoci/CVE-2023-6401.git 進入專案目錄 cd CVE-2023-6401-main 編譯DLL gcc -shared -o dbghelp.dll dbghelp.c -Wall...

CVE-2023-39361

CVE-2023-39361 Unauthenticated SQL injection in Cacti v1.2.24 Overview Cacti is an open-source operational monitoring tool written in PHP, MySQL/MariaDB, which provides a friendly interface. The vulnerability was found in 2023 which affected all versions before 1.2.24. This security flaws lies in...

CVE-2025-9215

StoreEngine Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Download The StoreEngine plugin contains a vulnerability in its CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2025-1639

🔓 Exploit Script for CVE-2025-1639 📝 Description The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This...

RE11S_1.11-formAccept-CommandInjection

RE11S1.11-formAccept-CommandInjection During my internship at Qi An Xin Tiangong Lab, I discovered a command injection vulnerability in the RE11S1.11 router. By analyzing the webs file in the bin directory, I found that the function formAccept contains a command injection vulnerability. The...

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

Reflected XSS in Login Form Email & Password Fields Vvveb CMS v1.0.7.2 Author: Andrew Paul Date of Discovery: August 12th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.7.2 and likely prior versions CVE ID: CVE-2025-9728 Summa...