CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2021-39512-BigTreeCMS-v4.4.14-AccountTakeOver

BigTreeCMS-v4.4.14-Unauthenticated-CSRF-AccountTakeOver Unauthenticated CSRF Account TakeOver in BigTreeCMS v4.4.14 All searchable modules in the admin panel of BigTreeCMS v4.4.14 are vulnerable to reflected DOM-XSS via the URI. Search queries are reflected on the page without proper sanitization...

CVE-2023-42793

CVE-2023-42793 description A security vulnerability in JetBrains TeamCity allows an attacker to create a new user given by the attacker with administrative privileges. Usage example ./cve-2023-42793 http://teamcity.examplewebsite.com username password...

CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below

CVE-2023-37756 – Weak Password Requirement in admin-center lead to malicious plugin upload in the i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to weak password requirement vulnerability in admin-center + malicious plugin upload lead to RCE vulnerability. These vulnerabilities...

CVE-2026-93892

The IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are vulnerable to an information disclosure vulnerability (CWE-200). A remote authenticated attacker can obtain sensitive information because session tokens are exposed within the HTML response in the Admin console. To remediate th...

CVE-2026-93892 Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2021-22911

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taki...

CVE-2024-7593_PoC_Exploit

CVE-2024-7593 Exploit Script This Bash script serves as a proof of concept PoC for exploiting the authentication bypass vulnerability in Ivanti vTM CVE-2024-7593. It allows users to create a new admin user on the target system. Table of Contents Prerequisites Usage Parameters Example Author Licen...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB Bypass Authentication simple poc bypass auth if you want to access via browser don't forget to change USERAGENT variable in script according to what is displayed in your browser so it can work. use cookie editor to replace value sid and u Affected: phpBB 3.3.16 and below +...

iTop-CVEs-exploit

iTop-CVEs-exploit This repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get admin privileges on the software. Set up 1. Download the vulnerable iTOP version from docker sudo docker run -d -p 8090:80 --name=my-itop2 vbkunin/itop:3.1.1 2...

CVE-2022-32199

CVE-2022-32199 ScriptCase python CVE-2022-32199.py -t 127.0.0.1 -u admin -p admin -path windows/win.ini Example of deleting file in the root directory...

CVE-2021-41074

CVE-2021-41074 CSRF in Qloapps HotelCommerce 1.5.1 There is a CSRF in HotelCommerce 1.5.1. It can allow anyone to change the admin email. If an attacker gets an admin to click a maliciously crafted html document, they can change the admin user email...

CVE-2020-6287_SAP-NetWeaver-bypass-auth

CVE-2020-6287SAP-NetWeaver-bypass-auth Automated Exploit for CVE-2020-6287 CVE-2020-6287: SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks...

harbor-give-me-admin

Harbor Admin Account Creation Vulnerability Detection Tool 0x00 Overview In 201909, Harbor disclosed a vulnerability that allows adding an administrator through the registration function. By using the registration API /api/users and crafting a POST parameter "hasadminrole": true, an administrator...

CVE-2023-39144

CVE-2023-39144 Background I discovered this vulnerability in May of 2023. Element55 produces software for law offices to track time. This software pulls information from various locations, such as Exchange, SQL, and Shoretel. Timeline May 24, 2023 - Reported vulnerability to Element 55 May 25, 20...

CVE-2025-2825

CVE-2025-2825/CVE-2025-31161 Introduction This document presents a security analysis of vulnerability CVE-2025-2825 affecting the server component of CrushFTP — a commercial solution for file transfer and storage FTP, SFTP, HTTP/S, S3-like interfaces, etc.. The defect is classified as an...

CVE-2023-41508

CVE-2023-41508 CVE-2023-41508 - A hard-coded password in Super Store Finder v3.6 allows attackers to access the administration panel. Vulnerability Type Incorrect Access Control Vendor of Product Super Store Finder Affected Product Code Base Super Store Finder - Affected version 3.6 or below. Fix...

CVE-2024-32371

CVE-2024-32371 Description Description A vulnerability identified as CVE-2024-32371 allows an attacker to elevate privileges by changing the type parameter from 1 to 0. This vulnerability enables an attacker with a regular user account to escalate their privileges and gain administrative access t...

CVE-2026-109565

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109567

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin rol...