CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

CVE-2026-114630

The ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions

EUVD-2026-118189

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

CVE-2026-123325

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page...

CVE-2026-123322

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

CVE-2026-123321

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects...

CVE-2026-123308

In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects...

CVE-2026-123302

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery...

CVE-2026-123304

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path...

CVE-2026-123293

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting...

CVE-2026-123278

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint...

CVE-2026-123280

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports...

CVE-2026-123279

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators...

CVE-2026-123276

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile...

Microsoft365_devicePhish

Microsoft365devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints t...

SNet

SNet 日本語版はこちら / Japanese version A CTF where you use AI to capture the flag. No pentesting experience? No problem. Claude Code acts as your personal trainer — it sets up the environment, teaches you the tools, and guides you through real attack techniques step by step. You type every command...

EvilClippy

This tool was released during our BlackHat Asia talk March 28, 2019. A video recording of this talk is available at https://www.youtube.com/watch?v=9ULzZA70Dzg. Evil Clippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code via P-Code and...

CVE-2026-93424

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peerfindtemplate in src/netflowplugin/netflowcollector.cpp and src/netflowplugin/netflowv9collector.cpp returns a pointer into globalnetflow9templates after releasing the cache mutex. On deployments with at...

dumpulator

dumpulator Note: This is a work-in-progress prototype, please treat it as such. Pull requests are welcome! You can get your feet wet withgood first issues An easy-to-use library for emulating code in minidump files. Here are some links to posts/videos using dumpulator: Introduction video with...

CVE-2025-49844

🚨 CVE-2025-49844 — “RediShell” Critical Remote Code Execution in the World's Fastest In-Memory Store Redis Lua scripting just became the perfect post-auth landing zone. Authenticated attacker → crafted Lua script → escape sandbox → full RCE on host ⚠️ Overview CVE-2025-49844 "RediShell " is a...