CVE-2025-1015

CVE-2025-1015: The Thunderbird Address Book contains unsanitized URI fields that could be exploited by attackers. By creating an address book with malicious links, an attacker may trick another user into importing the compromised address book. If the user clicks on the unsanitized link within...

CVE-2020-14292

CVE-2020-14292: A bluetooth transport issue in COVIDSafe App Author: Alwen Tiu, The Australian National University Last updated: 2020-09-08 Summary In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to tric...

CVE-2026-103527

Thelia v2.6.0's Smarty templates address.html and address-update.html fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript...

CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

EUVD-2026-97479

Thelia v2.6.0's Smarty templates address.html and address-update.html fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript...

CVE-2026-103527 CVE-2026-103527

Thelia v2.6.0's Smarty templates address.html and address-update.html fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript...

CVE-2026-103527

Thelia v2.6.0 is vulnerable to reflected Cross-Site Scripting (XSS) due to improper escaping of double quotes in the “next” parameter within the Smarty templates (address.html and address-update.html ). An authenticated user can be tricked into visiting a malicious link containing attacker-contro...

EUVD-2026-97476

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

CVE-2026-103523

Thelia v2.6.0 is susceptible to an open redirect vulnerability within its address creation workflow. The issue occurs because the application fails to validate the destination URL provided in the next parameter after a user submits the “Add New Address” form. Consequently, an attacker can provide...

CVE-2026-103523 CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

CVE-2023-5561-PoC

CVE-2023-5561-PoC WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack Source:...

CVE-2023-23397

CVE-2023-23397 A proof of concept for CVE-2023-23397 for security testing. Modify lines 11 and 12 with the attacker UNC path and target email address...

exploit-CVE-2016-10034

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

shadowhammer

Batch-mode shadowhammer MAC address checker Kaspersky recently discovered and analysed the 'Shadowhammer' attack https://securelist.com/operation-shadowhammer/89992. They did some great analysis and released a tool for sysadmins to use to determine if their systems were targetted. The released...

CVE-2023-4279

CVE ID : CVE-2023-4279 Vulnerability Type : IP Address Spoofing Description : This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce : 1. In User...

CVE-2018-13341

CVE-2018-13341 This Tool Aims to Exploit the CVE-2018-13341, By Using the MAC address of the targeted device, you can recover the password of the "crengsuperuser" hidden account which has elevated privileges and allow you to run SUDO commands. The Crestron Toolbox Protocol CTP can be connected to...

CVE-2026-76071

CVE-2026-76071: Unauthenticated Pre-Auth Stack Buffer Overflow via sscanf %^, in skkset.cgi ipFilterList Handler in Netis NC63 Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76071 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Rout...

OpenSMTPD-CVE-2020-7247-

OpenSMTPD Remote Command Execution Vulnerability CVE-2020-7247 WHS 4th Park Solmin Original link: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md Overview OpenSMTPD is an SMTP server program used on Unix-like operating systems. It c...

CVE-2023-49977

CVE-2023-49977 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "Address" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor...

CVE-2022-25064

CVE-2022-25064 TP-LINK TL-WR840N RCE via the function oalwan6setIpAddr POC POST /cgi?2&2&2 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:95.0 Gecko/20100101 Firefox/95.0 Accept: / Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip,...