Voting Delay set to 1 block, would not allow users enough time to buy tokens, or delegate their votes before the voting starts

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. With a voting delay set to 1 block, users would not have enough time to buy tokens, or delegate their votes. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick

CVE-2022-44268-Exploit Expoit for CVE-2022-44268 Arbitrary Fi...

Reflected XSS in date

Description There is a reflective XSS on the FOSSBilling admin screen. Proof of Concept By accessing the following URL, it is possible to execute any script on the browser of the logged-in administrator user. URL:...

GHSA-HM9V-VJ3R-R55M

creationtimestamp| type| source ---|---|--- 2023-06-30 22:15:17+00:00| published-proof-of-concept| https://t.me/cibsecurity/65818...

CVE-2023-36807

creationtimestamp| type| source ---|---|--- 2023-06-30 22:15:17+00:00| published-proof-of-concept| https://t.me/cibsecurity/65818...

CVE-2020-9289

creationtimestamp| type| source ---|---|--- 2023-06-30 15:51:30+00:00| published-proof-of-concept| https://t.me/crackcodes/3780 2023-07-01 09:06:39+00:00| published-proof-of-concept| Telegram/rQMVu4dwJRh1-j8AkvL2ouV19FMmA1TDUkwtOokmEHAkfA 2023-07-06 11:08:24+00:00| published-proof-of-concept|...

Open Redirect via deskDomain

Description This vulnerability occurs because the desired domain value can be inserted into the A tag through deskDomain manipulation. javascript if window.location.hash != null && window.location.hash.substring0, 9 == 'TICKETS' try var temp = JSON.parsedecodeURIComponent...

XSS Reflected via import file funtion

Description The application does import data from the file without cleaning the data inside before processing, resulting in javascript code that can be injected and triggered when the victim executes the function. Proof of Concept Step1: The attacker creates a .csv file containing a payload to...

Stored XSS via user's Full Name

Description The user's full name is rendered as HTML during user deletion. This enables an user to add Javascript code in the username which when can be executed in admin's webpage during user deletion. Proof of Concept - Login as a normal user and change the Full name to: javascript "...

CVE-2023-34838

creationtimestamp| type| source ---|---|--- 2023-06-29 10:33:57+00:00| published-proof-of-concept| https://t.me/kasraonecom/330 2026-07-29 12:00:21+00:00| seen| https://t.me/CVEhub/15692 2026-07-30 00:00:41+00:00| seen| https://t.me/CVEhub/15692 2026-07-31 00:00:34+00:00|...

CVE-2023-34843

creationtimestamp| type| source ---|---|--- 2023-06-28 07:44:18+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4637 2023-06-29 11:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8578 2023-06-30 15:51:30+00:00| published-proof-of-concept|...

Stored XSS in Title

Description Spina's admin screen has an embedded XSS in the title of the page. By embedding arbitrary JavaScript code in the function of Paguri, arbitrary scripts can be executed on the browser when the administrator user who accessed the page deletes the page. Proof of Concept Step 1. Access the...

CVE-2023-31541

creationtimestamp| type| source ---|---|--- 2023-06-27 16:22:20+00:00| published-proof-of-concept| https://t.me/HackerOne/3515 2023-08-10 14:30:31+00:00| published-proof-of-concept| https://t.me/MrVGunz/808 2026-07-29 12:00:25+00:00| seen| https://t.me/CVEhub/14727 2026-07-30 00:00:46+00:00| seen...

CVE-2023-29078

creationtimestamp| type| source ---|---|--- 2023-06-27 08:54:53+00:00| published-proof-of-concept| https://t.me/androidMalware/1890...

CVE-2023-29079

creationtimestamp| type| source ---|---|--- 2023-06-27 08:54:53+00:00| published-proof-of-concept| https://t.me/androidMalware/1890...

CVE-2023-28153

creationtimestamp| type| source ---|---|--- 2023-06-27 08:54:53+00:00| published-proof-of-concept| https://t.me/androidMalware/1890...

Microsoft 365 MSO 2305 Build 16.0.16501.20074 Remote Code Execution

Title: Microsoft 365 MSO Version 2305 Build 16.0.16501.20074 64-bit Remote Code Execution Vulnerability Author: nu11secur1ty Date: 04.17.2023 Vendor: https://www.microsoft.com/ Software: https://www.microsoft.com/en-us/microsoft-365/ Reference:...

CSRF in the delete notification function

Description The web application is vulnerable to CSRF in the delete notification function. Proof of Concept Step 1: See that user demo has some notifications. Step 2: Host an HTML trap page and send the URL to the victim history.pushState'', '', '/' document.forms0.submit; And the malicious URL...

Path Traversal in uploadAttachment

POC : see https://1drv.ms/v/s!Avwg5C1eKVA4gl3LF2hgRyVNrSqk?e=DHbHKF We also contact the Maintainer through email lujie.ac.cn...

Stored XSS at Search page

Description Create new item with XSS payload. Then go to Search page, XSS vulnerability will be trigger. Proof of Concept https://drive.google.com/file/d/1OB11FmQvy2-qRI9r1BlavKUxJ4kaMjp/view?usp=sharing Acknowledge Tran Van Nhan from bl4ckh0l3 of GalaxyOne...