CVE-2020-23584

CVE-2020-23584 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Unauthenticated remote code execution on "OPTILINK OP-XT71000N, Hardware Version: V2.2". The issue occurs when the attacker passes arbitrary commands with IP-ADDRESS using " ...

CVE-2023-34599

CVE-2023-34599 Multiple Cross-Site Scripting XSS vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. Proof of Concept Parameter allUsers http://gibbon.local/index.php?q=/modules/Timetable...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2025-2304-POC

CVE-2025-2304 Privilege Escalation in Camaleon CMS Example root@kitploit: python3 exploit.py http://target.com attacker attacker After successful exploitation, logout and login again to gain admin privileges. References https://nvd.nist.gov/vuln/detail/CVE-2025-2304...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Remote Code Execution PoC A Go proof of concept for CVE-2025-59528 targeting Flowise versions...

CVE-2026-82396

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/id/download/slug route and its administration variant to honor the inline query parameter for...

EUVD-2026-66395

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2020-24913-PoC

CVE-2020-24913-PoC A Poc for CVE-2020-24913, a SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request. This PoC is performed using a MyS...

EUVD-2026-68891

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/id/download/slug route and its administration variant to honor the inline query parameter for...

CVE-2026-82396

Sulu , an open-source PHP CMS built on Symfony, is affected by a stored XSS in MediaStreamController.php prior to versions 2.6.25 and 3.0.8 . The /media/{id}/download/{slug} route honors the inline=1 query parameter for scriptable MIME types (text/html, application/xhtml+xml, text/xml, applicatio...

CVE-2026-82396 Sulu: Stored XSS via media download inline-disposition override

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/id/download/slug route and its administration variant to honor the inline query parameter for...

CVE-2026-82396 Sulu: Stored XSS via media download inline-disposition override

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/id/download/slug route and its administration variant to honor the inline query parameter for...

CVE-2026-82396 Sulu: Stored XSS via media download inline-disposition override

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/id/download/slug route and its administration variant to honor the inline query parameter for...

CVE-2026-81892

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2025-63607

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

CVE-2025-22964

CVE-2025-22964: Time-based blind SQL injection in DDSN Interactive cm3 Acora CMS version 10.1.1 DDSN Interactive cm3 Acora CMS version 10.1.1 has a time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows...

CVE-2025-29306

CVE-2025-29306 FOXCMS Content Management System Service Parameter Injection Vulnerability 1. Vulnerability Overview FoxCMS is a free, commercially available and open-source website management system built on PHP+MySQL architecture. FOXCMS Content Management System has a service parameter injectio...

CVE-2023-4698

CVE-2023-4698 Local File Inclusion LFI in usememos/memos 0.13.2 Description Today, I want to shine a spotlight on a significant discovery — a critical security vulnerability that has been identified in usememos/memos. This vulnerability, which falls under the category of Local File Inclusion LFI,...

CVE-2024-34472

CVE-2024-34472 Description: An authenticated user can abuse Blind SQL injection vulnerability exists in the mliRealtimeEmails.php file. The ordemGrid parameter in a POST request to /mailinspector/mliRealtimeEmails.php does not Properly sanitize input, allowing an authenticated attacker to execute...