proofpoint-CVE-2023-0089

About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Low level authenticated user to admin RCE CVE: CVE-2023-0089 Timeline: Discovered - ly1g3 Reported - ly1g3...

CVE-2020-1956

CVE-2020-1956 CVE-2020-1956 Apache Kylin exploits Kylin 2.3.0-2.3.2,Kylin 2.4.0-2.4.1,Kylin 2.5.0-2.5.2,Kylin 2.6.0-2.6.5,Kylin 3.0.0-alpha,Kylin 3.0.0-alpha2,Kylin 3.0.0-beta,Kylin 3.0.0-3.0.1 and admin competence...

CVE-2025-1242

CVE-2025-1242: Exposure of Administrative IoT Hub Credentials Advisory Field| Value ---|--- CVE| CVE-2025-1242 ICSA| ICSA-26-055-03 CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published...

CVE-2023-49440

CVE-2023-49440-POC Exploit Title: AhnLab EPP ManagementCentralised Endpoint Security Management - Boolean-based-SQL-Injection SQL Injection that led to RCE Date: 16 July 2023 CVE : CVE-2023-49440 Vendor Homepage: https://www.ahnlab.com/en Software...

CVE-2026-26718

Description Summary A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via ...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Authentication Bypass to Admin Account Takeover Description : Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover The Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative plugin for WordPress is...

CVE-2026-2586

Authenticated GlassFish EL Injection RCE CVE-2026-2586 An Expression Language Injection vulnerability in the GlassFish Administration Console allows an authenticated user to inject malicious EL expressions into parameters processed by the administrative web interface. Successful exploitation may...

CVE-2023-36884_patcher

CVE-2023-36884patcher CVE-2023-36884 affects Office 2016, 2019, 2021 versions. This is its temporary patch. After downloading, right-click and run with administrator privileges...

CVE-2026-51119

CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...

CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk! thanks for ©gbrsh, I improved the tool a bit...

Active-Directory-BadSuccessor

Active-Directory-BadSuccessor Overview In this room, we explore the BadSuccessor privilege escalation technique, a vulnerability that abuses delegated Managed Service Accounts dMSAs in Active Directory. The attack allows a user with sufficient control over a dMSA object to impersonate another...

CVE-2019-15896

CVE-2019-15896 LifterLMS = 3.34.5 - Unauthenticated Options Import Description Unauthenticated Options Import, which could lead to Website Redirection Administrator Account Creation Content Injection Stored XSS The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional inp...

CVE-2020-8816

CVE-2020-8816 A Python script to exploit CVE-2020-8816, a remote code execution vulnerability on the Pi-hole. This script uses the techniques found by François Renaud-Philippon to achieve remote code execution on a Pi-hole running a web interface version less than 4.3.3. The exploit requires the...

CVE-2026-54477

CVE-2026-54477: Admin Panel Missing Security Headers clickjacking / XSS Advisory Field| Value ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

JoomlaCVE20168869

Exploit for Joomla 3.4.4 - 3.6.4 CVE-2016-8869 and CVE-2016-8870 with File Upload web shell This is PHP port, original python source code provided by @link https://github.com/XiphosResearch/exploits/tree/master/Joomraa Usage: php exploit.php --username hacker -p password -e [email protected]...

CVE-2023-42793

CVE-2023-42793 - TeamCity Admin Account Creation lead to RCE use exploit.py first to creat administrator account for you and then use rce.py to execute commands on the target, and for reverse shell check this exploit script Description This script exploits CVE-2023-42793 to create an admin accoun...

CVE-2015-9357-POC

CVE-2015-9357 wordpress smiley/emoticon parser stored xss, admin user creation via forged nonce request. breaks out of attribute context through the emoticon regex, lands js in an onerror handler. no script tag needed, survives wpkses filtering on the affected field. chain: submit payload to any...

CVE-2026-8181

CVE-2026-8181 This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by using any incorrect password in a Basic Authentication header. Attackers could abuse this flaw to create a new administrator account...

CVE-2026-23550

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗ ███████╗██║██╔██║ ██║ ╚█...

CVE-2024-5009

CVE-2024-5009 PoC for Progress WhatsUp Gold SetAdminPassword Privilege Escalation CVE-2024-5009 A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/progress-whatsup-gold-privesc-setadminpassword-cve-2024-5009/ Usage python3 CVE-2024-5009.py --target...