CVE-2025-29602

CVE-2025-29602 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

CVE-2026-115245

The Chat AI with Dispatcher WordPress plugin (versions before 2.4 ) contains an unauthenticated arbitrary file upload vulnerability. The root cause is insufficient validation of uploaded files, as the plugin relies on a spoofable client-supplied content type. This allows an attacker to upload arb...

EUVD-2026-112629

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

CVE-2026-115245 Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

CVE-2026-103693

The Frontend Dashboard WordPress plugin (before 3.0.5 ) and the ProfileGrid WordPress plugin (before 6.0.0.5 ) are vulnerable to an unauthenticated PHP object injection vulnerability. The root cause is a failure to prevent unauthenticated users from storing a serialized PHP object in user metadat...

CVE-2026-103693 Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...

EUVD-2026-112616

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...

CVE-2026-115301

The Contact Form by Supsystic WordPress plugin, in versions before 1.11.1 , is vulnerable to Server-Side Template Injection (SSTI) . The root cause is the lack of sandboxing for the template engine used to render forms, allowing stored form-editor content to be processed as executable template co...

EUVD-2026-112610

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute...

CVE-2026-115301 Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute...

CVE-2022-46169

Cacti remoteagent.php Remote Command Execution Vulnerability CVE-2022-46169 Vulnerability Description Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For...

CVE-2024-55347

CVE Disclosure: CVE-2024-55347 Public Disclosure of CVE-2024-55347 🚀 Date: 10-02-2025 Summary A Binary Planting vulnerability in Kroll Artifact Parser And Extractor KAPE v1.3.0.2 allows attackers to escalate privileges and execute arbitrary code by placing a maliciously crafted Binary file in a...

CVE-2024-3273-D-Link-Remote-Code-Execution-RCE

CVE-2024-3273 - D-Link Remote Code Execution RCE Exploit Description This repository contains an exploit for CVE-2024-3273 , a critical vulnerability found in specific D-Link devices that allows for Remote Code Execution RCE. The vulnerability arises from improper input validation in the...

Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Overview This project demonstrates the vulnerability CVE-2024-21513 in the langchain-experimental package, specifically in versions =0.0.15 and 0.0.21. The vulnerability allows arbitrary code execution via the VectorSQLDatabaseChain component when retrieving values from t...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept POC by CRFSlick, discovered by AkkuS An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal...

CVE-2020-8813

CVE-2020-8813 Cacti v1.2.8 Unauthenticated Remote Code Execution Uses Python 3 Running without Docker: git clone https://github.com/hexcowboy/CVE-2020-8813.git && cd CVE-2020-8813 python3 -m venv env && source env/bin/activate pip install -r requirements.txt python exploit.py Running with Docker:...

CVE-2020-6418

CVE-2020-6418 The CVE 2020-6418 is about the the type confusion in V8 in Google chrome.The affected versions were prior to 80.0.3987.122. The vulnerability is achived by remote attacker accessing the shell of a target device via a crafted HTML page. Environment Requirements 1. Google Chrome with...

Grav-CMS-RCE-Authenticated

Grav CMS Remote Code Execution Authenticated - CVE-2024-28116 Info This code is an adaptation fromGraver Github repository with some improvements based on this video. Exploit against Grav CMS for versions below 1.7.45 based on SSTI + RCE vulnerabilities, labeled as CVE-2024-28116. This script...

CVE-2024-1655

CVE-2024-1655 Description ASUS ExpertWiFi EBM63, EBM68, and RT-AX57 Go firmwares before the 12-04-2024 patch contain a command injection vulnerability in splashpageSDN.cgi function. When an attacker sends a specially crafted request, they can achieve arbitrary code execution. references: Official...

CVE-2024-24590-ClearML-RCE-Exploit

CVE-2024-24590 — ClearML Pickle Artifact RCE Overview Field| Details ---|--- CVE| CVE-2024-24590 Software| ClearML Affected Versions| 0.17.0 – 1.14.2 Vulnerability| Unsafe pickle deserialization of task artifacts Authentication| Requires write access to a ClearML project Impact| Remote Code...