Joplin 3.3.3 Server - Privilege Escalation

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/-id t...

WordPress Metform <=2.1.3 - Information Disclosure

WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...

LiteLLM < 1.25.0 - Remote Code Execution

LiteLLM before 1.25.0 allows authenticated users with the master API key to execute arbitrary Python code through the /guardrails/testcustomcode endpoint intended for custom guardrail testing. The endpoint’s insufficient filtering mechanisms can be bypassed, allowing attackers to abuse Python’s...

ChanCMS <= 3.3.0 - SQL Injection

yanyutao0402 ChanCMS = 3.3.0 contains a SQL injection caused by manipulation of the "key" argument in app/modules/api/service/Api.js Search function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request. id: CVE-2025-10210 info: name: ChanCMS = 3.3.0 - SQL...

Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

WordPress Events Calendar 6.8.2.1 - Information Disclosure

The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication. id: CVE-2024-5333 info: name: WordPress Events Calendar 6.8.2.1 - Information Disclosu...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative function...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

bug-bounty-reports-desai-vinayak

🧩 Report Bug Bounty — Desai Vinayak 🔒 Report di bug bounty e ricerca sulle vulnerabilità di Desai Vinayak. Questo repository raccoglie report passivi e non distruttivi su vulnerabilità e prove a supporto per divulgazione coordinata e tracciamento della risoluzione. 📁 Contenuti 📂 reports/ — PDF,...

CVE-2024-8522

CVE-2024-8522 LearnPress – WordPress LMS Plugin execute class-lp-course-db.php:564, LPCourseDB-getcourses Courses.php:241, LearnPress\Models\Courses::getcourses class-lp-rest-courses-v1-controller.php:502, LPJwtCoursesV1Controller-getcourses class-wp-rest-server.php:1230,...

CVE-2023-2732

CVE-2023-2732 Lo scanner delle vulnerabilità delle API WordPress Mstore è uno strumento potente e facile da usare progettato per identificare potenziali vulnerabilità nei siti WordPress ispezionando i loro endpoint API. Lo scanner mira ad aiutare proprietari di siti web, sviluppatori e...

CVE-2025-12721

g-FFL Cockpit = 1.7.1 - Esposizione di informazioni non autenticata Il plugin g-FFL Cockpit non implementa controlli di autorizzazione adeguati sull'endpoint REST API serverstatus, consentendo a utenti non autenticati di accedere a informazioni sensibili sulla configurazione del server,...

iac-scan-runner

IaC Scan Runner Service that scans your Infrastructure as Code for common vulnerabilities...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

CVE-2018-7691

CVE-2018-7691 Die SSC REST API enthält Schwachstellen bezüglich Insecure Direct Object Reference IDOR, die authentifizierten Benutzern Zugriff auf beliebige Details der lokalen und LDAP-Benutzer über die POST-Methode und auf beliebige Details der Fortify-Projekte anderer Benutzer über die...

CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS يخلط بين بيانات القالب الخالصة وخيارات تكوين المحرك من خلال واجهة برمجة تطبيقات العرض Express. من خلال الكتابة فوق خيارات التكوين الداخلية، قد يتم تشغيل تنفيذ التعليمات البرمجية عن بُعد في التطبيقات النهائية. المصدر...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

EvilSlackbot

EvilSlackbot Slack कार्यस्थानों में रेड टीम और फ़िशिंग अभ्यास संचालित करने के लिए एक Slack Attack Framework। अस्वीकरण यह उपकरण केवल सुरक्षा पेशेवरों के लिए है। किसी भी Slack कार्यस्थान के खिलाफ परीक्षण करने की स्पष्ट अनुमति के बिना इस उपकरण का उपयोग न करें। अपने जोखिम पर उपयोग करें। पृष्ठभूमि...

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 è una vulnerabilità di esecuzione remota di codice in Metabase. La vulnerabilità deriva da un difetto di sicurezza nella gestione delle stringhe di connessione JDBC da parte di Metabase quando processa l'endpoint API non autenticato...