s2-048

s2-048 Exp for s2-048, CVE-2017-9791. / \ \ / / | | \ / / | | / \ / / | | | \ \ / /| | | | | | | / /| | / / | | | | \ V / | ||/ /| || | | / /, |/ / , | | | / || ||/||// //// //|| poc:...

QuickBox-Pro-2.1.8-Authenticated-RCE

QuickBox-Pro-2.1.8-Authenticated-RCE An authenticated low-privileged user can exploit a command injection vulnerability to get code-execution as www-data and escalate privileges to root due to weak sudo rules. QuickBox Pro v2.1.8 and prior is vulnerable...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built on the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as a CMS...

chall2026-telneted

@Hack 2026: Telneted Authored by Harsh. Category : Pwn Solves : 34/120 Tags : beginner Protocol : telnet Recon team has found another endpoint in the Aliens' network, but we can't seem to be able to connect to it with our tools. Network captures show a user 'astrax' using it smuggle secret data...

CVE-2019-14529

CVE-2019-14529 Multiple SQL Injection vulnerability in OpenEMR project Vulnerable function in file: /openemr/interface/forms/eyemag/save.php Conditions : any authorized user Vulnerable versions: 5.0.2, Fixed in 5.0.2 version. Description There are two functions: 1. "storePDF", with non filtered...

EUVD-2026-112086

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...

CVE-2026-50541

The Xibo open source digital signage platform is vulnerable to an IDOR (Broken Object-Level Authorization) flaw in versions prior to 4.4.3 . The root cause is missing access-control checks on the GET /dataset/export/csv/{id} endpoint, which allows an authenticated user to export data from any dat...

CVE-2023-2591

CVE-2023-2591: Stored HTML Injection in Item Label in Teampass 3.0.6 - M Nadeem Qazi I recently identified a security vulnerability in nilsteampassnet/teampass, a popular password management tool. This vulnerability, identified as CVE-2023-2591, is a stored HTML injection vulnerability in the ite...

CVE-2026-67074

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise...

CVE-2026-116404

Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16...

CVE-2026-116391

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9...

CVE-2026-116392

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25...

Project-Field-Analysis-and-Memory-Leak-Demonstration

Objective The objective of this project was to assess a remote host for the Heartbleed vulnerability CVE-2014-0160, verify its presence, and exploit it to extract potentially sensitive information from server memory over the TLS protocol. Execution 1. Identifying Open Services Nmap nmap -sC -sV...

cve-2022-26134

cve-2022-26134 cve-2022-26134 atlassia Confluence Data Center2016 server OGNL %...

CVE-2025-61777

CVE-2025-61777 1. Unauthorized modification of badge templates on FlagforgeCTF CVE-2025-61777 Summary The Flagforge application https://flagforge.xyz exposes critical vulnerabilities in its administrative API endpoints, specifically /api/admin/badge-templates GET and...

CVE-2021-24884

CVE-2021-24884 XSS2RCE in Formidable 4.09.04 Formidable 4.09.04 allowed to inject certain HTML Tags like ,,, and . This could allow an unauthenticated, remote attacker to exploit a HTML-injection by injecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If...

EUVD-2026-112073

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25...

CVE-2026-116391

The GS Logo Slider plugin for WordPress (versions n/a through 3.8.9 ) is vulnerable to PHP Object Injection via the deserialization of untrusted data . This flaw allows an attacker to inject objects, potentially leading to high impacts on confidentiality, integrity, and availability. No specific ...

EUVD-2026-112074

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9...

CVE-2026-116391 WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9...