CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - Divulgation d'informations utilisateur Ce dépôt contient un exploit preuve de concept PoC pour la CVE-2026-53959 Avertissement Ce projet est fourni à des fins éducatives et pour des tests de sécurité autorisés uniquement. Ne l'utilisez pas contre des systèmes qu...

CVE-2026-78584

CVE-2026-78584 is an Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature that allows an authenticated user with Osquery live-query privileges to determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. The vulnerability affects...

CVE-2026-79991

Craft CMS is affected by an authenticated vulnerability in its GraphQL entry mutation resolvers (saveEntry, deleteEntry). The resolvers read siteId directly from $arguments without passing it through ArgumentManager::prepareArguments(), which normally enforces site-scope filtering via array_inter...

CVE-2026-79991 Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-29115

CVE-2026-29115 — Déni de service distant authentifié chez Dahua Type d’avis : Divulgation de sécurité coordonnée avec le fournisseur Identifiant CVE : CVE-2026-29115 Fournisseur : Dahua Technology Publié le : 2026-06-10T06:08:21 UTC Dernière modification : 2026-06-10T06:08:21 UTC Source : Centre ...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Preuve de concept REDMINE JUSQU'À 3.2.9/3.3.9 INJECTION SQL https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Prérequis : Identifiants d'accès Sous-projet requis API REST activée Sur Mysql, la première requête sur laquelle l'injection se produit ressemble à l'exemp...

PoC-CVE-2019-12840

Exploit pour CVE-2019-12840 dans Webmin Ce dépôt contient un script Python qui exploite la vulnérabilité CVE-2019-12840 dans Webmin. Description Le script tente de se connecter à un serveur Webmin, puis d'exploiter la vulnérabilité CVE-2019-12840. Le script accepte plusieurs arguments en ligne de...

CVE-2026-84802

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo , which fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to ret...

CVE-2026-84802 Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrie...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

Exploit RCE OpenSTAManager CVE-2026-38751 Aperçu Ce script Python exploite une vulnérabilité d'exécution de code à distance dans OpenSTAManager version 2.10, identifiée comme CVE-2026-38751. L'exploit permet aux utilisateurs authentifiés de télécharger un module malveillant et d'exécuter des...

CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload Существует множество неограниченных загрузок файлов, которые приводят к произвольному выполнению PHP-кода. Аутентифицированные уязвимые страницы: localhost/officeadmin/?pid=54&action=add root@kitploit:...

CVE-2026-33229

CVE-2026-33229 — Apache Velocity 샌드박스 우회를 통한 XWiki RCE XWiki Platform 의 원격 코드 실행 취약점으로, 스크립팅 권한이 있는 인증된 사용자가 Java Reflection 없이도 Velocity 컨텍스트에 이미 존재하는 사전 인스턴스화된 객체를 탐색하여 Apache Velocity 샌드박스를 완전히 우회할 수 있습니다. 📄 전체 기술 세부 정보: youssefazefzaf.com/posts/cve 세부 정보...

EUVD-2026-69851

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

CVE-2025-45250

CVE-2025-45250 Description suggérée root@kitploit: MrDoc =0.95 est vulnérable à une falsification de requête côté serveur SSRF dans la fonction validateurl du fichier appdoc/utils.py. POC root@kitploit: POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your...

CVE-2024-50803-Redaxo

CVE-2024-50803 XSS stocké dans la fonctionnalité mediapool de Redaxo Une vulnérabilité de cross-site scripting XSS stocké a été découverte dans les versions de Redaxo 5.18.0, permettant à des attaquants disposant de privilèges suffisants de téléverser un fichier SVG malveillant via la...

CVE-2026-84715 FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted request to grant themselves full server control, enablin...

CVE-2026-84715

FeatherPanel versions before 1.3.7.10 contain a privilege escalation vulnerability in the SubuserController updateSubuser handler. The handler fails to properly validate permissions, allowing an authenticated subuser with minimal access to send a crafted request that modifies their own permission...

CVE-2026-84694 Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

CVE-2024-57785

CVE-2024-57785 root@kitploit: Exploit Title: Authenticated File Inclusion Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57785 Usage: CVE-2024-57785.py -h -u URL -f FILE optional...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — Injection de commandes OS dans mediaclip.cgi d'AXIS Étude technique n-day et PoC — analyse technique post-correctif d'une vulnérabilité d'injection de commandes OS de score CVSS 7.1 dans l'API VAPIX Media Clip d'AXIS, redécouverte indépendamment et vérifiée par des tests en boîte...