CVE-2026-22599

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-22599 CVE-2026-22599 Strapi 5.33.1 - Strapi I am @abraxasnull. Loopback lab. The client is CVE-2026-22599-Abraxas-Labs.py. Content-Type Builder write API database-query injection. Yup validates but does not...

CVE-2023-40028

CVE-2023-40028: Ghost CMS Symlink Exploitation PoC Overview This repository contains a Proof-of-Concept PoC script designed to demonstrate the exploitation of CVE-2023-40028 , a Local File Inclusion LFI vulnerability affecting Ghost CMS versions prior to 5.59.1. The vulnerability allows...

CVE-2026-107573

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2023-40028

Proof of Concept PoC for CVE-2023-40028 CVE-2023-40028 is a vulnerability in Ghost CMS that allows arbitrary file reads through improper file handling. This PoC demonstrates how the exploit works under controlled conditions. Educational use only. Reference: Adapted from the original PoC by...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE in WordPress WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file With wavefile npm $ make make-wav Step4...

CVE-2023-40931-PoC

CVE-2023-40931 The sqlmap payload to exploit CVE-2023-40931 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id=3&token=curl -ksX POST...

exploit-CVE-2019-14530

OpenEMR CVE-2019-14530 exploit OpenEMR --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder Filename of the file to be read Username of the admin Password of the admin --debug Display arguments -h, --help Show this screen Examples: exploit.rb...

POC_CVE-2025-14700

CVE-2025-14700 PoC for CVE-2025-14700 , a Server-Side Template Injection SSTI vulnerability in Crafty Controller = 4.6.1. This vulnerability allows authenticated users to achieve Remote Code Execution RCE by injecting malicious Jinja2 templates into the Webhook configuration. 📦 Installation Clone...

CVE-2025-66837

CVE-2025-66837 Malicious File Upload Description A file upload vulnerability in ARIS allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware CVSS Score: 6.8 Medium Attack Type Remote Authenticated Affected Versions Versions before 10.0.23.0.3587512 Discovered By: Yazan...

CVE-2023-31702

CVE-2023-31702 — eScan Management Console SQL Injection Authenticated Overview CVE-2023-31702 is an authenticated SQL Injection vulnerability discovered in MicroWorld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GetUserCurrentPwd endpoint, where th...

CVE-2024-9264

CVE-2024-9264 python CVE-2024-9264.py '' -u '' -p '' -c ''...

CVE-2021-2109

CVE-2021-2109 Weblogic Server Remote Code Execution Vulnerability Reproduction and Analysis In January 2021, Oracle released a security update patch, including 329 new security patches in the Oracle product family. This announcement specifically mentioned the Oracle WebLogic Server security...

CVE-2018-3252

CVE-2018-3252-PoC 1.Generate PoC with YSOSERIAL 2.You should know the USERNAME and PASSWORD of the target weblogic server 3.Send the payload to the URL POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 Accept:...

EUVD-2026-94855

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2026-107573 Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2026-107573 Incorrect Default Permissions in hMailServer

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2026-107573

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 on Windows suffer from incorrect default permissions in the installer. The installer creates data, log, temp, database, and event folders, along with the hMailServer.INI configuration file, using permissions inherited from the installatio...

CVE-2025-63307

CVE-2025-63307 – Authenticated Stored Cross-site Scripting XSS in laravel-file-manager v3.3.1 🧭 Overview An authenticated Stored Cross-site Scripting XSS vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitra...

CVE-2025-24367

CVE-2025-24367 - Cacti Authenticated Graph Template RCE Usage & Safety Important — Read this first: This repository and exploit.py are provided for educational and research purposes only. Do not use this code against systems, networks, or services for which you do not have explicit, written...

CVE-2024-46256

CVE-2024-46256 Nginx Proxy Manager RCE Vulnerability Analysis Environment Setup 1. Running Nginx Proxy Manager 2.11.3 Environment docker-compose up -d Or you can use the automated script: python setupenvironment.py 2. Accessing Nginx Proxy Manager URL: http://localhost:81 Complete the initial...