EUVD-2026-110797

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

EUVD-2026-110789

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rexapipackage API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like...

EUVD-2026-110826

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module Qt Core in Qt 5 and earlier impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and ma...

CVE-2026-117532

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2021-1732

CVE-2021-1732 CVE-­2021­-1732 Microsoft Windows 10 local privilege escalation vulnerability research and PoC/Exploit development Affected systems and application versions Windows Server, version 20H2 Server Core Installation Windows 10 Version 20H2 for ARM64­based Systems Windows 10 Version 20H2...

qubes-core-admin

Qubes core, version 3 This is master branch of the Qubes OS core. API documentation is available: https://dev.qubes-os.org/projects/core-admin/en/latest/...

CVE-2026-117532

REDAXO core versions 5.3.0 through 5.21.4 are vulnerable to an authentication bypass within the structure/history plugin. This flaw allows unauthenticated attackers to force the session-tied secret into a predictable state , enabling the forgery of temporary login tokens. An attacker can leverage...

CVE-2026-63030

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Batch Route Confusion + CVE-2026-60137 SQL Injection Zero-dependency exploitation toolkit for the wp2shell vulnerability chain in WordPress Core. A single anonymous HTTP request achieves remote code execution on a default WordPress installatio...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 SQL injection for unauthenticated remote code...

CVE-2026-4813

CVE-2026-4813 CVSS-B 9.4 CRITICAL Authenticated RCE via XSLT injection in Lutece Core Explanations and more on my website /xsl:styleshee...

pmd

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

coraza

Coraza - Web Application Firewall Coraza is an open source, enterprise-grade, high performance Web Application Firewall WAF ready to protect your beloved applications. It is written in Go, supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set v4. Website:...

dvcsharp-api

Damn Vulnerable C Application API Only Getting Started Note: This is a deliberately vulnerable app, please do not host it on production or Internet/public facing servers. Use with caution. Docker docker-compose up Manual Install .NET Core 2.x SDK Microsoft .NET Core SDK Install dependencies and...

CVE-2026-27344

Broken Access Control in Inseri Core WordPress Plugin Plugin: Inseri Core Affected Component: /includes/restapi.php Vulnerability Type: Broken Access Control Missing Authorization Status: Reported in August 2026– Closed as Duplicate. Summary Whilst testing this summer I came across a Broken Acces...

operative-framework

operative framework is a digital investigation framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules. important The project has undergone a...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei Detection Template Template Nuclei for non-intrusive detection of XSS2Shell , a pre-authenticated differential parser in WordPress Core that allows injection of DOM elements into the login page, serving as the basis for an XSS → RCE chain. ⚠️ This template only detects the...

CVE-2018-7602

CVE-2018-7602 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - High...

CVE-2024-29847

CVE-2024-29847 PoC for Ivanti Endpoint Manager AgentPortal Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-29847 A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/ivanti-epm-CVE-2024-29847-deserialization-RCE/ Usage...

CVE-2025-55315

CVE-2025-55315 Proof-of-concept exploit for CVE-2025-55315 .NET HTTP Request Smuggling. Demonstrates how improperly parsed chunked encoding lets attackers smuggle requests past proxies and load balancers in vulnerable ASP.NET Core/Kestrel servers. 📊 Presentation View Interactive Prezi Presentatio...

Log4JShell-Bytecode-Detector

🔍 Log4JShell Bytecode Detector Log4jShell Bytecode Detector is an open source tool that helps identify if a jar file is affected by the critical CVE-2021-44228. The tool scans the jar file and compares the classses against a set of vulnerable hashes for classes within the jar file. The hashes hav...