PT-2026-116108

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...

PT-2026-116107

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

Cisco-SNMP-Slap

OVERVIEW cisco-snmp-slap utilises IP address spoofing in order to bypass an ACL protecting an SNMP service on a Cisco IOS device. Typically IP spoofing has limited use during real attacks outside DoS. Any TCP service cannot complete the inital handshake. UDP packets are easier to spoof but the...

cisco-SNMP-enumeration

Cisc0wn - Cisco SNMP Script Cisco SNMP enumeration, brute force, config downloader and password cracking script. Tested and designed to work against Cisco IOS Switches and Routers. Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Daniel Compton, daniel dot compton ...

CVE-2025-48932---exploit

Invision Community SQL Injection Exploit CVE-2025-48932 A proof-of-concept exploit demonstrating a SQL injection vulnerability in Invision Community versions = 4.7.20. ⚠️ Disclaimer This tool is provided for educational and authorized security testing purposes ONLY. Unauthorized access to computer...

CVE-2025-48932-Invision-Community-SQLi-Exploit

🔓 CVE-2025-48932 - Invision Community SQL Injection Exploit ⚡ Critical Vulnerability Overview CVE-2025-48932 is a critical unauthenticated blind SQL injection vulnerability discovered in Invision Community versions ≤ 4.7.20. This exploit allows remote attackers to: 🔍 Extract sensitive database...

CVE-2024-35584

CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...

CVE-2020-13158

CVE-2020-13158 - Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000 active...

oss-bounty-program

ProjectDiscovery OSS Bounty Program Purpose The ProjectDiscovery OSS Bounty Program exists to democratize security by rewarding meaningful contributions from the global community. Our tools are used by researchers, defenders, and builders worldwide. This program ensures that anyone, anywhere, can...

CVE-2025-47916

CVE-2025-47916 - Invision Community Remote Code Execution RCE Vulnerability About This repository provides a proof‑of‑concept description for CVE‑2025‑47916 , a Remote Code Execution vulnerability affecting Invision Community versions 5.0.0 through 5.0.6. The issue stems from improper handling of...

ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy A hands-on implementation of NIST FIPS 204 ML-DSA in a two-tier PKI hierarchy using EJBCA Community Edition. 📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA What This Lab Builds A comple...

Linux Distros Unpatched Vulnerability : CVE-2026-93582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER...

CVE-2026-110110

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...

CVE-2026-110109

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110110

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...

CVE-2026-110110 JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...

CVE-2026-110110

JetLinks Community through version 2.10.0 is vulnerable to a missing authorization flaw (CWE-862) in the AlarmConfigController . Specifically, the _enable and _disable endpoints lack the required save action annotation . This allows users with only query access to toggle alarms by ID, potentially...

CVE-2026-110109

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110109 JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110109

Versions of JetLinks Community through 2.10.0 are susceptible to a missing authorization vulnerability (CWE-862) in the transparent-codec component. An attacker with only query access can exploit the POST /device/transparent-codec/{productId} endpoint, which lacks the required @SaveAction permiss...