cve-2024-25423

cve-2024-25423 An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d file. Additional Information Cinema 4D out-of-bounds write vulnerability when parsing c4d files Affected Component c4dbase.xdl64 Tested Versions CINEMA 4D R2024.2.0 Attack Type...

Metasploit-Attack-Report

This repository does not have a README...

CVE-2020-16270

CVE-2020-16270 Suggested description : OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s...

CVE-2025-1974

cve-2025-1974-win11-attack-defense-lab Windows 11-first educational repository for studying CVE-2025-1974 in a safe, non-weaponized ATTACK + DEFENSE lab. The project is designed for university coursework, team demos, and report-ready screenshots. It emphasizes clean-room implementation, local-onl...

CVE-2026-108682: Improper Resource Shutdown or Release

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the publi...

CVE-2026-108860: Use of Hard-coded Cryptographic Key

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

PT-2026-110354

A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr...

PT-2026-110106

A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui view session spend logs of the file litellm/proxy/spend tracking/spend management endpoints.py of the component Spend Tracking. Executing a manipulation of the argument session id can lead to...

o365-attack-toolkit

¿Qué es o365-attack-toolkit o365-attack-toolkit permite a los operadores realizar ataques de phishing oauth. Decidimos pasar del antiguo modelo de definiciones estáticas a ser completamente "interactivos" con la cuenta en tiempo real. Algunos de los cambios Búsqueda interactiva de correos...

CVE-2022-24611

CVE-2022-24611 Details regarding the Z-Wave S0-No-More attack. For a full analysis and report how this works and how to reproduce the findings see the attached PDF file. Short description: Denial of Service attack against S0 and S2 devices tested with the Z- Wave ZW5xx product line, here...

Nuke.sh

NUKE - Recon & Attack Surface Mapper | \ | | | | | |/ / | | | | | | | ' /| | | |\ | || | . | | || |/||\| N U K E // recon & attack surface mapper ----------------------------------------- Bash-based passive reconnaissance + attack surface mapping script using only public APIs + stock Linux...

CVE-2022-37706

CVE-2022-37706 The CVE-2022-37706 vulnerability is related to the Enlightenment window manager, specifically the enlightenmentsys binary. This binary has the SUID Set User ID bit enabled, meaning it can be executed with elevated privileges usually as the root user. Summary: Vulnerability :...

CVE-2025-32463

Vulnerability Overview CVE-2025-32463 affects Sudo versions 1.9.14 through 1.9.16 fixed in 1.9.17p1. When Sudo is invoked with the --chroot option, it may load configuration from an attacker-controlled path, leading to arbitrary code execution and privilege escalation to root. Usage: python3...

CVE-2020-24028

CVE-2020-24028 Description ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Insecu...

CVE-2025-9074-POC

CVE-2025-9074-POC Proof-of-Concept exploit for CVE-2025-9074 ⚠️ Legal Disclaimer This PoC is released for educational and authorized security testing purposes only. Unauthorized exploitation of systems is illegal and unethical. Use this PoC only on environments you own or have explicit permission...

CVE-2020-10132

CVE-2020-10132 - CVE-2020-10132 - SearchBlox product before V-9.1 is vulnerable to CORS misconfiguration. Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total...

CVE-2010-5230

CVE-2010-5230 Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse 1 mptools.dll, 2 baseman.dll, 3 wintab32.dll, or 4 wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl...

disclosure-thinkware-u3000

Thinkware U3000 Dashcam: Vulnerabilità di Sicurezza Tre vulnerabilità nel protocollo di controllo WiFi locale della dashcam Thinkware U3000, scoperte tramite reverse engineering dell'app Android ufficiale e confermate su hardware reale. Tutte e tre richiedono solo l'accesso alla rete locale: ness...

CVE-2024-48591

CVE-2024-48591 Vulnerability Disclosure: XSS in Inflectra SpiraTeam 7.2.00 Description Inflectra SpiraTeam version 7.2.00 is vulnerable to Cross-Site Scripting XSS through the upload of specially crafted SVG files, which can execute JavaScript when viewed directly. Vulnerability Type Cross-Site...

CVE-2024-50849

CVE-2024-50849: Stored XSS in the WorldServer v11.8.2 A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code. An authenticated high-privileged user must go to the "Rules" page...