CVE-2026-125347

Google Chrome versions prior to 157.0.8103.50 are vulnerable to an incorrect authorization flaw in the FileSystem component (CWE-863). A remote attacker can leverage social engineering to execute arbitrary code outside the sandbox by navigating to a crafted HTML page. This vulnerability is classi...

CVE-2026-125347

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-125343

A heap-based buffer overflow in the Compositing component of Google Chrome (prior to version 157.0.8103.50 ) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox. The attack can be triggered via a crafted HTML page . Remediation i...

EUVD-2026-121416

Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-121417

Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-121415

Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-125346

...

EUVD-2026-121389

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

awesome-appsec-interview

Awesome AppSec Interview A curated list of resources, practice questions, and study materials to help you prepare for Application Security Engineer interviews, organized by interview type. Contents Interview Overview Secure Code Review Threat Modeling Coding & Scripting Scenario-Based Interviews...

cve-2025-29384-poc

CVE-2025-29384 Proof-of-Concept Exploit Overview This repository contains an advanced proof-of-concept PoC exploit for CVE-2025-29384 , a critical stack-based buffer overflow vulnerability discovered in the Tenda AC9 router running firmware version V15.03.05.14multi. This vulnerability allows...

CVE-2022-35737

CVE-2022-35737 Integer overflow in SQLite3 sqlite3strvappendf function. CVSS 6.7 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-35737 was introduced in SQLite version 1.0.12 and fixed in release 3.39.2, available on July 21, 2022. It is exploitable on 64-bit systems, and exploitability depends on h...

CVE-2025-55182

React2Shell: CVE-2025-55182 Walkthrough Author: Kavienan J Vulnerability discovered by: lachlan2k, who responsibly disclosed it to the React team. For updates on this vulnerability, visit: react2shell.com Table of Contents 1. Introduction 2. Background 3. Understanding ReactFlightReplyServer.js 4...

CVE-2021-24155.rb

WordPress-Backup-RCE This Metasploit module allows an attacker with a privileged WordPress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard versions prior to 1.6.0. This is due to an incorrect check of the uploaded file extension whi...

nginx-cve-2026-42945-check

NGINX CVE-2026-42945 Local Checker Language: 中文 | English This repository provides two standalone local scripts for checking whether a Linux or Windows server has Nginx, OpenResty, or Tengine instances that may be exposed to CVE-2026-42945 related risk. The scripts are read-only. They do not run ...

Firefox-CVE-2024-9680

Firefox CVE-2024-9680 CVE-2024-9680 Description An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox 131.0.2, Firefox E...

CVE-2024-0757-Exploit

CVE-2024-0757 Exploit Description The Insert or Embed Articulate Content into WordPress plugin for WordPress is vulnerable to arbitrary file uploads through insecure file uploads in a zip archive in all versions up to, and including, 4.3000000023. This makes it possible for unauthenticated...

appsec-agent

AppSec Agent AI-powered security agents for code review, PR scanning, threat modeling, fix generation, and more. You can use AppSec Agent in three ways: Path| Best for| Get started ---|---|--- CLI agent-run| Trying agents from your terminal| Getting started npm library| Building your own app or...

ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

CVE-2026-20798

Uncontrolled search path for some IntelR Graphics Driver software installers within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable local code execution. This result may...

react2shelldemo

React2Shell CVE-2025-55182 — Local RSC Security Demo ⚠️ WARNING This repository is for educational and defensive security research only. Do NOT attempt to run this code against: Production systems Public websites Servers you do not own or have explicit permission to test Unauthorized exploitation...