offsec-osgi-exploits

OSGi Exploits This repository contains exploits for multiple OSGi versions. OSGi v3.7.2 and Below OSGi v3.8-3.20...

EUVD-2026-85272

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...

HPESBNW05137 rev.1 - Multiple Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. ArubaOS Wi-Fi Controllers and Gateways ALE 5.0.0.0 and below CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-76708 |...

HPESBNW05151 rev.1 - Remote DoS in remote Telco service Orchestrator

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator 5.6.0 and below CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-69185 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A...

EUVD-2025-210740

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

CVE-2026-39897: Improper Neutralization of Input During Web Page Generation

Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the htmlauthfooter. This issue has been fixed in version 1.2.31...

EUVD-2026-33614

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 Path...

CVE-2026-40544: Improper Neutralization of Input During Web Page Generation

SOPlanning is vulnerable to Stored Cross-Site Scripting XSS via /process/uploadbackup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the...

EUVD-2026-30930

Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior e.g. using a debugger and log in as any other user or administrator - then it is possible to do every...

CVE-2026-33741: Improper Neutralization of Input During Web Page Generation

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the attachment and image entry...

CVE-2026-40552: Incorrect Resource Transfer Between Spheres

Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an...

CVE-2026-27467: Exposure of Sensitive Information to an Unauthorized Actor

BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio to the server regardless of mute state. Media is discarded at the server side, so it isn't audible to any participants, but this may allo...

CVE-2026-27492: Exposure of Data Element to Wrong Session

Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties such as to, subject, html, text, and attachments are not reset between sends when a single client instance is reused across multiple .send calls. This can cause properties from a...

WordPress personal-authors-category plugin <= 0.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin personal-authors-category versions = 0.3...

CVE-2026-23831: NULL Pointer Dereference

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate returns nil success when message is...

CVE-2026-24117: Server-Side Request Forgery (SSRF)

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate...

PT-2026-3916

Appsmith and Affected Versions Appsmith versions 1.94 and below Description Appsmith is a platform used for building admin panels, internal tools, and dashboards. Publicly accessible applications in versions 1.94 and below are susceptible to a bypass of the expected publish boundary...

CVE-2025-68133: Allocation of Resources Without Limits or Throttling

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new...

CVE-2025-69197: Improper Authentication

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This...

CVE-2026-21675: Use After Free

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create function, where it deletes the hint. This issue is fixed in version 2.3.1.1...