CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...

CVE-2025-61686_docker

CVE-2025-61686docker Start 1. Build docker-compose up --build 2. Start docker-compose up Reproduction Steps 1. Construct a session that meets the path traversal condition └─$ echo -en '"AAAA../../../tmp/flower"'|base64 -w0 | tr '+/' '-' | tr -d '=' IkFBQUEuLi8uLi8uLi90bXAvZmxvd2VyIg 2. Put the...

Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-10720-PoC

Description This proof of concept PoC describes an authentication bypass vulnerability found in the WordPress plugin WP Private Content Plus v3.6.2. The issue allows unauthenticated users to bypass password-protected content due to improper reliance on client-side cookies. Details Vulnerability...

CVE-2024-3400-Palo-Alto-OS-Command-Injection

Steps : 1. Check whether file 0xr2r.txt is present on device by running below get request or We can verify same by openinig https://domain.com/global-protect/portal/images/0xr2r.txt Url in browser if you get 404 response that means file is not present. POST /ssl-vpn/hipreport.esp HTTP/1.1 Host:...

CVE-2020-16270

CVE-2020-16270 Suggested description : OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s...

CVE-2023-6700

CVE-2023-6700 Cookie Information | Free GDPR Consent Solution = 2.0.22 - Authenticated Subscriber+ Arbitrary Options Update Description: CVE-2023-6700 The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability che...

CVE-2022-24706

CVE-2022-24706 Contributors White Hat School 4th Batch 39th Class Geum Jeong-hyeon@junghyeonkum CouchDB Erlang Distribution Remote Command Execution Vulnerability CVE-2022-24706 Summary Apache CouchDB is an open-source document-oriented NoSQL database implemented in Erlang. Because Apache CouchDB...

CVE-2024-40511

CVE-2024-40511 Cross Site Scripting vulnerability in openPetra v.2023.02 via the serverMServerAdmin.asmx function. Description : An unauthenticated user can steal cookies from authenticated user, by exploiting a XSS in openPetra v.2023.02 via the serverMServerAdmin.asmx function. Vulnerable Produ...

cve-2026-100671-poc

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal, local-only verifier for the Grav content-Twig/page-cache session takeover fixed in Grav 2.0.25. Advisories: CVE-2026-100671 GHSA-pp89-h475-7gj6 Grav 2.0.25 release Scope exploit.py is deliberately restricted to loopback targets:...

CVE-2025-50363_BXSS_CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Privilege Escalation via Blind XSS Affected Versions:v1.0 💣Vulnerability Description: A Blind Cross-Site Scripting XSS vulnerability was discovered in the Maid Hiring Management System, which allows a...

CVE-2024-6529

Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...

cve-2024-3400-panos_rce_reproduction

CVE-2024-3400: Palo Alto PAN-OS GlobalProtect Command Injection RCE CVSS 10.0 CRITICAL | CWE-78: OS Command Injection | Mass Exploited In The Wild Overview CVE-2024-3400 is a pre-authentication command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway interface...

CVE-2024-3400-POC

CVE-2024-3400 RCE Test Script Overview This Python script is designed to test for a remote code execution RCE vulnerability, specifically CVE-2024-3400, which affects certain Palo Alto Networks GlobalProtect portals. The vulnerability allows unauthorized command execution via cookie manipulation...

CVE-2023-31852

CVE-2023-31852 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/config has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

CVE-2025-29602

CVE-2025-29602 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

CVE-2022-29359

School Club Application System Issue: Unauthenticated Stored Cross-Site Scripting to HTML injection to RCE Author: Zak Clifford Date: 12.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software:...

CVE-2020-29667

CVE-2020-29667 Insufficient Session Expiration | Predefined Cookie Value Suggested description In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system and operate remote ATM...

CVE-2021-42664

CVE-2021-42664 CVE-2021-42664 - Stored Cross-Site Scripting vulnerability in the Engineers online portal system. Technical description: A stored XSS vulnerability exists in the Engineers online portal system. An attacker can leverage this vulnerability in order to run javascript on the web server...

CVE-2025-26159

CVE-2025-26159 This script may only be used in authorized environments where explicit permission has been granted. The author is not responsible for any misuse, damage, or consequences resulting from the use of this script. This script decodes, filters, and extracts cookies as part of the...