Weblate-CVE-2026-24126

Weblate — Arbitrary File Read via SSH Host Argument Injection Discovered by: Alejandro Baño · January 2026 Acknowledged by: Weblate 5.16 release notes Overview Weblate's SSH host key management endpoint passes the host parameter supplied by an authenticated administrator directly tossh-keyscan...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin CVE-2026-6741 — LatePoint Privilege Escalation Scanner Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...

CVE-2025-8081-Elementor

CVE-2025-8081 - Elementor Arbitrary File Read Vulnerability A critical arbitrary file read vulnerability in Elementor WordPress plugin that allows authenticated administrators to read any file accessible by the web server, including sensitive configuration files containing database credentials. 📋...

CVE-2017-12542

CVE-2017-12542 This script checks if an HP iLO server is vulnerable and can add an admin user...

CVE-2023-22515-joaoviictorti

CVE-2023-22515 Overview Compile Usage Running CVE-2023-22515 Overview Confluence is a web-based enterprise wiki developed by Australian software company Atlassian. Atlassian has been made aware of an issue reported by some customers where external attackers may have exploited a previously unknown...

CVE-2025-60880

CVE-2025-60880: Stored Cross-Site Scripting XSS in Bagisto Admin Panel An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be...

CVE-2026-6433

CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS, JS & PHP · Unauthenticated SQL injection → RCE via eval Affected: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · WordPress plugin surface via admin-ajax.php At a glance Item| Detail ---|--- Vector| Unauthenticated SQLi tunneled through plugin...

CVE-2026-36436-Public-Reference-Pack

CVE-2026-36436-Public-Reference-Pack Summary A vulnerability in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code using standard browser developer tools to...

CVE-2025-6934

CVE-2025-6934 unauthenticated privilege escalation in opal estate pro Description CVE-2025-6934 is a critical vulnerability in the Opal Estate Pro WordPress plugin ≤ v1.7.5. This bug allows an unauthenticated attacker to create a new administrator account by sending a crafted request to:...

CVE-2026-2991

KiviCare = 4.1.2 - Authentication Bypass CVE-2026-2991 PoC 📜 Description CVE-2026-2991 is an authentication bypass vulnerability in the KiviCare – Clinic & Patient Management System EHR WordPress plugin affecting all versions up to and including 4.1.2. The plugin exposes a public REST endpoint at...

CVE-2026-61343-poc-librebooking-rce

CVE-2026-61343-poc-librebooking-rce Librebooking Admin RCE PoC CVE-2026-61343...

CMS-Made-Simple-2.2.9-CVE-2019-9053

Disclaimer This repository provides a Python 3 compatible exploit targeting an unauthenticated SQL injection vulnerability in CMS Made Simple versions 2.2.9 and earlier. The flaw, tracked as CVE-2019-9053, allows attackers to extract sensitive administrator data, including username, hashed...

CVE-2025-54352

CVE-2025-54352 PoC Usage Steps to install and test the WordPress PoC: 1. Install a fresh version of WordPress using Docker: 1.1 Start the MySQL database container: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e MYSQLROOTPASSWORD=rootpass -d...

CVE-2025-60375

CVE-2025-60375 — PerfexCRM Authentication Bypass Advisory ID: perfexcrm-auth-bypass-2025 CVE: CVE-2025-60375 Product: PerfexCRM Affected versions: versions prior to 3.3.1 3.3.1 Reported by: Ajansha Shankar, Ahamed Yaseen References: OWASP Authentication Cheat Sheet —...

CVE-2026-8181-Lab

CVE-2026-8181 — Burst Statistics Authentication Bypass Lab Local-only Docker lab for CVE-2026-8181 , an authentication bypass in the WordPress plugin Burst Statistics – Privacy-Friendly WordPress Analytics. This lab compares a vulnerable plugin version against the patched version and uses a...

CVE-2025-34157

Stored XSS in Coolify delete flow CVE-2025-34157 Affects: Coolify ≤ v4.0.0-beta.420.6 Fixed in: v4.0.0-beta.420.7 Severity: Critical 9.4 CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site Scripting, CWE-20 Improper Input Validation Summary A...

CVE-2025-60375

CVE-2025-60375 CVE-2025-60375 — Authentication bypass / incorrect access control in PerfexCRM Note: Steps above are the original discovery steps reported by Ajansha Shankar and Ahamed Yaseen. References OWASP Authentication Cheat Sheet — gui...

CVE-2023-24249-PoC

CVE-2023-24249 PoC CVE-2023-24249 is an arbitrary file upload vulnerability in laravel-admin v1.8.19. This proof of concept exploits the vulnerability to upload a web shell. The exploit was written to use against the HackTheBox easy machine Usage. Example python3 CVE-2023-24249.py + Web shell...

CVE-2025-56311

CVE-2025-56311: Security Advisory – CSRF Vulnerability in FD602GW-DX-R410 Router Reboot Function Proof of Concept and Security Advisory for a Cross-Site Request Forgery CSRF vulnerability in the FD602GW-DX-R410 fiber router’s admin interface Firmware V2.2.14. The advisory outlines the impact,...

CVE-2025-65271

CVE-2025-65271 PoC for CVE-2025-65271 How to run? node server.js Description Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard...