CVE-2026-111987

A Cross-Site Scripting (XSS) vulnerability exists in AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1 . The flaw is located within the Extra-Networks Card Builder component, specifically in the read_metadata_from_safetensors function of the modules/sd_models.py file. An attacker can trig...

CVE-2020-28414

CVE-2020-28414 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

EUVD-2026-103506

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function getobjfromstr of the file modules/sdmodels.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. T...

CVE-2026-111986 AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function getobjfromstr of the file modules/sdmodels.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. T...

CVE-2026-111986

The AUTOMATIC1111 stable-diffusion-webui (up to version 1.10.1 ) is vulnerable to a code injection flaw within the Model Instantiation component. Specifically, the get_obj_from_str function in modules/sd_models.py fails to properly handle the Target argument, allowing an attacker to initiate a re...

CVE-2025-4802-Proof-of-Concept

CVE-2025-4802 — Proof of Concept ⚠️ Disclaimer: This repository is for educational and authorized security research purposes only. Do not use this exploit against systems you do not own or have explicit permission to test. Misuse may violate laws and regulations. CVE Summary Field| Details ---|---...

CVE-2011-1237

CVE-2011-1237 This is an old POC for CVE-2011-1237 on Windows 7 written in 2013. The vulnerability was discovered by Tarjei Mandt @kernelpool and explain in his paper Kernel Attacks through User-Mode Callbacks. Several things are hardcoded in this POC and it call the Null page which does not work...

CVE-2020-13159

CVE-2020-13159 - Artica Proxy before 4.30.000000 Community Edition allows Multiple OS command injection. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000...

CVE-2022-4896

CVE-2022-4896 PoC & exploits for CVE-2022-4896 "Control de Ciber" is a Cybercafe management software. Multiple Denial-of-Service DoS vulnerabilities in versions prior to 1.650. An unauthenticated remote attacker can send a carefully crafted request that lead to a service crash. Spooler DoS Spoole...

CVE-2023-27704

CVE-2023-27704 CVE-2023-27704 Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service ReDoS fix at Everything 1.5 alpha Suggested description Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of...

CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

CVE-2026-112050

Versions of Gitify before 7.10.0 are vulnerable to a login cross-site request forgery (CSRF) . The issue stems from the performGitHubWebOAuth() function omitting OAuth state validation . A remote attacker can trick a victim into binding their client to the attacker's account by providing a gitify...

EUVD-2026-103512

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

CVE-2026-111985

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function readmetadatafromsafetensors of the file modules/sdmodels.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It i...

CVE-2025-27591-below-

CVE-2025-27591 – Privilege Escalation in Below 1 Introduction Below is a Linux tool for recording and displaying system data such as hardware utilization and cgroup metrics. In versions prior to v0.9.0 , Below’s systemd service runs with root privileges and creates world-writable log directories...

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

CVE-2026-111985 AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function readmetadatafromsafetensors of the file modules/sdmodels.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It i...

CVE-2026-111985

A vulnerability exists in AUTOMATIC1111 stable-diffusion-webui up to version 1.10.1 within the Metadata Extraction component. Specifically, the read_metadata_from_safetensors function in the modules/sd_models.py file is susceptible to resource allocation issues. An attacker can manipulate the hea...

CVE-2025-24071-PoC

CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Proof of Concept Overview CVE-2025-24071 is a spoofing vulnerability in Windows File Explorer that allows an unauthenticated attacker to expose sensitive information over a network. The vulnerability arises due to the implicit trust an...

CVE-2022-0185-Analysis-and-Exploit

CVE-2022-0185-Analysis-and-Exploit Research and proof-of-concept for CVE-2022-0185 Linux kernel heap overflow vulnerability. CVE-2022-0185 – Linux Kernel Heap Overflow Analysis Overview CVE-2022-0185 is a heap-based buffer overflow vulnerability in the Linux kernel’s filesystem context...