Linux Distros Unpatched Vulnerability : CVE-2026-98667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different...

PS4-6.20-WebKit-Code-Execution-Exploit

PS4 6.20 WebKit Code Execution PoC This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.js. It will then...

Invoke-PSImage

Invoke-PSImage Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute Invoke-PSImage takes a PowerShell script and encodes the bytes of the script into the pixels of a PNG image. It generates a oneliner for executing either from a file of from the web. It can...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin Account Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-8181 Plugin| Burst Statistics – Privacy-Friendly WordPress Analytics Affected Versions| 3.4.0 – 3.4.1.1 Patched Version| 3.4.2 CVSS Score| 9.8 Critica...

tesla-security-research

Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...

cve-2023-41564-research

CVE-2023-41564 Vulnerability Overview CVE-2023-415641 is a stored XSS vulnerability in the CMS Cockpit = v2.6.3. When a .shtml HTML file is uploaded during file upload, JavaScript is executed the moment the uploaded file is opened. 1: https://nvd.nist.gov/vuln/detail/CVE-2023-41564 Attack Executi...

CVE-2026-13181-CVE-2026-13182-CVE-2026-13183-CVE-2026-13184

CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184 Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

BlackLotus-Z2A-Challenge

BlackLotus-Z2A-Challenge BlackLotus-Z2A-Challenge, Nothing to see here 4 now , please move along First things first For aesthetic purposes soley, I will shamesly borrowsteal : from @darthmaulwareRyan “DM” Smith solution the yara detection rules just to make it look proffesional. Go check his...

Heartbleed_Dockerfile_with_Nginx

Testing Heartbleed with Nginx Dockerfile This repository contains Dockerfile of Nginx with the vulnerable OpenSSL version 1.0.1f for testing CVE-2014-0160 Heartbleed Vulnerability. Base Docker Image debian:latest Installation 1. Install Docker Example with Debian: apt-get install -y docker 2...

CVE-2025-54309

CVE-2025-54309 CrushFTP Authentication Bypass Overview CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP that allows unauthorized administrative user creation through AS2 header manipulation. Technical Details Vulnerability Location File : crushftp/server/ServerSessionHTTP.java...

CVE-2025-59528

Version francaise CVE-2025-59528 Proof of Concept Minimal PoC focused on technical validation of the vulnerability in an authorized environment. Prerequisites You must have a user account on the target Flowise dashboard. You must have a valid API key linked to that account. You must start a...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

CVE-2026-82329

CVE-2026-82329 Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...

LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320

🧠 LetsDefend SharePoint Zero-Day Analysis ToolShell - SOC342-CVE-2025-53770 📘 Introduction I investigated a SharePoint zero-day called ToolShell CVE-2025-53770 in the LetsDefend cyber lab. The exercise mimicked a real-world zero-day RCE attack where a malicious POST request bypassed authenticatio...

CVE-2025-67923

CVE-2025-67923 Exploitation Report JetEngine = 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API Date: March 11, 2026 CVSS Score: 7.1 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Plugin: JetEngine = 3.7.7 Plugin Slug: jet-engine Fixed In: 3.7.8 CVE:...

LinusWare-Source-Code-Internal

Linusware 1.2 — Source Code & Engine Architecture Reconstructed, Reverse-Engineered & Documented by tekkenbugatti Target Platform: Linux x8664 / Luau / Roblox Runtime Engine Overview Linusware 1.2 is a native Linux x8664 runtime extension and execution engine for Roblox / Luau. This repository...

chamilo-lms-unauthenticated-big-upload-rce-poc

Chamilo LMS Unauthenticated Big Upload File RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and instal...

CVE-2019-13272

CVE-2019-13272 PTRACETRACEME CVE-2019-13272 local privilege escalation vulnerability analysis PTRACETRACEME is a privilege escalation vulnerability in the Linux Kernel discovered by Jann Horn in July 2019. Vulnerability Analysis: Ptrace is a system call that provides a method allowing a process...