CVE-2026-84906

Eventin WordPress plugin versions before 4.1.24 contain an unauthenticated payment bypass affecting its Stripe and PayPal integrations. The plugin fails to verify that a completed payment corresponds to the specific order it is applied to, checking only that the gateway reports the transaction as...

Vehicle-Service-Management-System-Category-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46071 익스플로잇 제목: Vehicle Service Management System - 'Category List' 저장형 크로스 사이트 스크립팅 XSS 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46071 CVSS: 4.8 중간 참고 자료: https://www.plsanu.com/vehicle-service-management-system-category-list-stored-cross-site-scripting-xss...

CVE-2026-86444

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

WordPress Tutor LMS plugin 4.0.0-4.0.7 - Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability

Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability discovered by Shirshak in WordPress Plugin Tutor LMS versions 4.0.0-4.0.7...

CVE-2023-0214

SWG Exploit Generator root@kitploit: ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhi...

CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358

Keycloak 's first broker login flow contains a flaw where a temporary proof created during a cross-browser account-linking request is not properly cleared after the link is established or manually removed. An attacker who controls the external identity can exploit this residual proof to silently ...

ZipCracker

ZipCracker ZipCracker is a simple but powerful password brute-force utility for cracking password-protected ZIP archives. It’s built with Qt and integrates a custom cracking engine, providing both CLI and GUI support. ⚡ Disclaimer: This tool is intended for educational purposes, recovery of your...

CVE-2025-70368

CVE-2025-70368 Stored Cross-Site Scripting XSS in Project Updates Feature...

CVE-2025-45407

CVE-2025-45407 CVE-2025-45407: DiscoveryNG v6.0.8 Hotfix 2의 다중 XSS 취약점 발견자: YallaSec 보안 연구팀 CVE ID: CVE-2025-45407 공개 날짜: 2025년 7월...

GHSA-XV26-6W52-CPH6 vulnerabilities

Vulnerabilities for packages: argo-workflows...

Kentico-Xperience-before-13.0.178---XSS-POC

이 저장소에는 README가 없습니다...

CVE-2024-50803-Redaxo

CVE-2024-50803 Redaxo의 mediapool 기능에서 발생하는 저장형 XSS Redaxo 5.18.0 미만 버전에서 저장형 교차 사이트 스크립팅XSS 취약점이 발견되었습니다. 충분한 권한을 가진 공격자가 mediapool 기능을 통해 악성 SVG 파일을 업로드할 수 있습니다. 분석 글 게시 : https://medium.com/@praison66/5d15a3cd054d Praison 이 2024년 9월에 발견했습니다. 참고 자료 : https://vulners.com/cve/CVE-2024-50803...

CVE-2025-0133

설명: CVE-2025-0133에 대한 POC로, GlobalProtect 게이트웨이 또는 포털이 활성화된 PAN-OS 방화벽 구성에만 적용됩니다. 파일에서 입력받은 여러 URL에 대해 사용자 지정 스레드로 취약점 여부를 확인합니다. 타임아웃을 설정하고 결과를 파일로 저장할 수도 있습니다. 사용 예시: MacBook-Wiseep-Dev:github root python3.9 CVE-2025-0133.py -h usage: CVE-2025-0133.py -h --file FILE --thread THREAD --timeout...

CVE-2026-92214

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site...

CVE-2023-36158

CVE-2023-36158 sourcecodester Toll Tax Management System 1.0에 존재하는 Cross Site Scripting XSS 취약점으로, 원격 공격자가 My Account 페이지의 First Name 및 Last Name 필드를 통해 임의 코드를 실행할 수 있습니다...

CVE-2026-92214

CVE-2026-92214 affects a2ui-project a2ui versions up to 0.10.7 , specifically the file sanitizer-markdown-renderer-service.ts within the a2a-chat-canvas Angular component. The vulnerability is a Cross-Site Scripting (XSS) flaw in an unknown function of that service. A remote attacker with low pri...

EUVD-2026-80059

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

CVE-2020-8559

Kubernetes CVE-2020-8559 개념 증명 PoC 익스플로잇 이것은 데모 목적으로만 사용됩니다. 관리 작업을 수행할 권한이 있고 CVE-2020-8559을 악용할 권한이 있는 시스템에서만 사용하십시오. 이것은 CVE-2020-8559에 대한 PoC입니다. 이 취약점은 공격자가 노드에서 root를 획득한 경우 클러스터의 다른 컨테이너에서 명령을 실행할 수 있게 하여 Kubernetes 마스터 노드를 장악할 수 있게 합니다. 이 취약점은 Kubernetes API 서버와 kubectl 명령이 HTTP 리디렉션을 따르는...

CVE-2019-12543

CVE-2019-12543 Zoho ManageEngine ServiceDesk Plus 9.3 PurchaseRequest.do의 XSS 취약점 정보 설명: Zoho ManageEngine ServiceDesk Plus 9.3에서 문제가 발견되었습니다. PurchaseRequest.do serviceRequestId 매개변수를 통한 XSS가 존재합니다. 작성자: Tarantula 팀의 Concobe - VinCSS Vingroup의 구성원 페이로드...