CVE-2019-13272

CVE-2019-13272 PTRACETRACEME NOTE: This python3 version of the exploit DOES NOT REQUIRE any external source. The sources that follows are just credits for the original exploit in C. Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=1903 Exposure: highly probable Tags:...

CVE-2026-91831

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

EUVD-2026-104101

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

CVE-2026-91831

The Subscribe to Comments WordPress plugin versions before 2.3.3 is vulnerable to an Email Header Injection flaw. The application fails to sanitize newline characters in the notification sender-name setting before utilizing them in email headers. This allows users with Author-level access or high...

CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

WordPress Subscribe to Comments plugin < 2.3.3 - Author+ Email Header Injection vulnerability

Author+ Email Header Injection vulnerability discovered by Het Kalariya in WordPress Plugin Subscribe to Comments versions 2.3.3...

XenoboxX

Hardware Sandbox Toolkit Malware frequently employs anti-VM techniques, which can vary in their difficulty to detect and counteract. While integrating anti-detection measures in our labs is a frequently used option, we should also consider using a real hardware sandbox, even if this sounds weird...

deco-filepush-disclosure

Deco XE75 Pro V3 — owner-authenticated debug channel: arbitrary root file write Companion VLAN project: experimental fixed-VLAN-30 source alpha for the exact XE75 Pro V3 firmware/profile. It requires operator-supplied stock files and has no general installer or flashable image. Guest VLAN 591...

cve-2020-0601_poc

Basic Info The source code of this tool is supposed to help with understanding of CVE-2020-0601 vulnerability discovered in Windows Crypto API, see CERT's overview. The tool itself can be used to produce a certificate for an arbitrary domain which will be signed by an evil certificate authority...

cve-2016-6662

About Some help to explot CVE-2016-6662 Warnings Make sure to change the attacker IP in the c file before compiling Credit All credit to original discoverer. Writeups here: http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html Discussion here:...

CVE-2025-22828

CVE-2025-22828 📜 Description Apache CloudStack 4.16.0 and later versions have a broken access control issue that allows users with knowledge of resource UUIDs to read or add comments annotations on resources they are not authorized to access. UUIDs can be exposed in various parts of the...

CVE-2023-30212-LAB

Creating a Vulnerable Docker Environment CVE-2023-30212 Description CVE-2023-30212 is a security vulnerability that affects versions of OURPHP prior to or equal to 7.2.0. This vulnerability allows for Cross-Site Scripting XSS attacks OURPHP Steps let’s download Dockerfile Open Terminal in the...

CVE-2022-21668-Pipenv-RCE-vulnerability

CVE-2022-21668-Pipenv-RCE-vulnerability 1. Introduction In this document the Pipenv vulnerabilityCVE-2022-21668 is discussed in detail. The following sections cover the bug code in pipenv/utils.py file which opens up the door for various RCE attacks and also about the recent fix which validates...

POC-CVE-2023-3244

proof of concept for CVE-2023-3244 Hello, this is a simple Proof of Concept PoC for the CVE-2023-3244 vulnerability found in the WordPress plugin "comments-like-dislike". The vulnerability affects plugin versions up to and including 1.2.0. To exploit this vulnerability, you can refer to the Pytho...

CVE-2026-7465-Lab

CVE-2026-7465 - Spectra Gutenberg Blocks Local Lab Local Docker lab for analyzing and reproducing CVE-2026-7465 in the WordPress plugin Spectra Gutenberg Blocks ultimate-addons-for-gutenberg. This lab compares: vuln: Spectra 2.19.25 patched: Spectra 2.19.26 The proof is intentionally least-harm. ...

PT-2026-118041

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

UBUNTU-CVE-2026-98786

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

PT-2026-117669

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The JPEG decoder in Pillow fails to verify the actual output width and component count after a scaling request is made. When an application uses draft or thumbnail to request downscaling of an 8-bit...

PT-2026-117673

Name of the Vulnerable Software and Affected Versions Pillow versions 9.2.0 through 12.11.0 Description When saving a GIF with a long comment, the library performs quadratic copying. The get global header function repeatedly copies portions of comment data while assembling the global header, whic...