CVE-2021-41074

CVE-2021-41074 CSRF in Qloapps HotelCommerce 1.5.1 There is a CSRF in HotelCommerce 1.5.1. It can allow anyone to change the admin email. If an attacker gets an admin to click a maliciously crafted html document, they can change the admin user email...

CVE-2023-22518

CVE-2023-22518 Exploit for Confluence CVE-2023-22518 backup-restore RCE Endpoint POST /setup/setup-restore.action Requires valid login and admin rights or an auth bypass Files xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!! Replace with any backup...

CVE-2025-8550

CVE-2025-8550 – atjiu pybbs XSS Exploit Description This repository hosts an automated Proof-of-Concept PoC exploit for CVE-2025-8550 , a reflected Cross‑Site Scripting XSS vulnerability in atjiu pybbs ≤ v6.0.0. It targets the /admin/topic/list endpoint’s username parameter, which lacks proper...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Unauthenticated PHP Object Injection Description The Lis Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.1 via deserialization of untrusted input. This makes it possible for unauthenticated...

GO-2026-6776 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda...

GO-2026-6730 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: Missing Authorization on Docker Plugin Endpoints → Host RCE Proof-of-concept for CVE-2026-44848 , a missing-authentication CWE-862 vulnerability in Portainer that lets a non-admin user with Docker endpoint access perform privileged Docker plugin operations → full host...

CVE-2020-14882-WebLogic-Analysis

Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...

CVE-2023-31851

CVE-2023-31851 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/status has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

EITS-Portal-Exploit-CVE-2026-31367-PoC

💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - RCE PoC This repository contains the Proof of Concept PoC for the unauthenticated Remote Code Execution RCE vulnerability in EITS Admin Dashboard v2.4.0 CVE-2026-31367. The vulnerability occurs due to a flaw in input sanitization on the /api/v1/debu...

CVE-2026-20896-Gitea-Authentication-Bypass

CVE-2026-20896 - Gitea ≤1.26.2 Authentication Bypass 1. What is Gitea? Gitea is a lightweight, open-source Git hosting platform that allows organizations and developers to manage source code repositories, track issues, review changes, and collaborate on software projects. It provides functionalit...

CVE-2026-26119

CVE-2026-26119 WAC RCE - CVE-2026-26119 Windows Admin Center authenticated RCE via WinREST/PowerShell invokeCommand. Usage: python3 wacrce.py "" WACPASS= python3 wacrce.py Env: WACBASE - override target base URL default below WACPASS - password, used if not passed positionally...

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept PoC went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involve...

CVE-2026-107082

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opachide and promoted GET parameters of admin/modules/bibliography/index.php, because escapestring is applied but the values are concatenated into an unquoted numeric SQL...

CVE-2026-107083

SENAYAN Library Management System SLiMS Bulian slims9bulian 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dldetail.php via the parameter fileID...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Admin Takeover PoC for missing CSRF protection on emlog pro's AI Assistant executetool endpoint, which lets an attacker ride an admin's authenticated session to run arbitrary SQL against the site database — including a full admin account...

CVE-2026-72898

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection Metabase Pre-Authentication SQL Injection Leading to Admin Takeover Proof-of-concept for CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password-reset endpoint. The PoC injects a forged admin session row into the...

CVE-2026-111046

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with...

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...