CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...

CVE-2021-44593

CVE-2021-44593 Public disclosure of CVE-2021-44593. A SQL injection/arbitrary file upload/remote code execution vulnerability in Simple College Website. DESCRIPTION Simple College Website 1.0 is vulnerable to an unauthenticated union-based SQL injection in the "username" parameter of the...

cve-2026-1731-scanner

CVE-2026-1731 — BeyondTrust RS/PRA Passive Vulnerability Scanner root@kitploit: ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ CVE-2026-1731 ║ ║ BeyondTrust RS/PRA Passive Vulnerability Scanner ║ ║ ║ ╠═══════════════════════════════════════════════════════════════╣ ║...

SneeitScanner-CVE-2025-6389

SneeitScanner-CVE-2025-6389 SneeitScanner - PoC & Scanner for Unauthenticated RCE in Sneeit Framework CVE-2025-6389 ⚡ SneeitScanner ⚡ Proof of Concept PoC and Automated Scanner for Unauthenticated RCE in Sneeit Framework CVE-2025-6389 This robust Python script is a functional PoC and scanner tool...

CVE-2021-42237

CVE-2021-42237 This is an exploit/PoC for CVE-2021-42237 taken from: This Assetnote report DISCLAIMER: I'm not associated with Assetnote in any way or form. This content is provided for educational porpouses only. Make sure to replace CMD-COMMAND-HERE, as well as the Host, from the PoC below:...

CVE-2026-42141-xibo-ssrf

CVE-2026-42141 - XIBO CMS SSRF SSRF vulnerability in Xibo CMS CVE-2026-42141 Description Server-Side Request Forgery SSRF vulnerability in Xibo CMS via the uploadUrl feature. This vulnerability was discovered during security research on Xibo CMS. Impact An authenticated user can force the server ...

CVE-2026-0920-WordPress-LA-Studio-Exploit

CVE-2026-0920 PoC: LA-Studio Element Kit Backdoor Exploit A robust Proof of Concept PoC exploit written in Go for the critical backdoor vulnerability found in LA-Studio Element Kit for Elementor plugin versions = 1.5.6.3. This tool demonstrates how an unauthenticated attacker can leverage the...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC Proof-of-concept demonstration for CVE-2026-39816, an EXECUTECODE permission bypass in Apache NiFi 2.8.0 that lets a flow designer who has been deliberately denied code-execution privileges run arbitrary Groovy in the NiFi JVM via the graph bundle's ExecuteGraphQuer...

CVE-2026-30863-Exploit

CVE-2026-30863 – Parse Server JWT Audience Validation Affected versions Parse Server 8.6.10 and 9.5.0-alpha.11 Vulnerable components Google auth adapter GoogleAuthAdapter Apple auth adapter AppleAuthAdapter Facebook auth adapter FacebookAuthAdapter Root cause When the adapter is configured withou...

CVE-2026-41177-Squidex-CMS

CVE-2026-41177: Squidex CMS Blind SSRF Technical research and analysis for CVE-2026-41177: A Blind Server-Side Request Forgery SSRF vulnerability in the Squidex CMS Restore API. Vulnerability Overview CVE ID: CVE-2026-41177 Affected Component: Squidex API: Backup / Restore Engine /api/apps/restor...

CVE-2024-11613-wp-file-upload

CVE-2024-11613-wp-file-upload Exploit by Chirag Artani https://3rag.com for CVE-2024-11613 in WordPress File Upload Here is information - The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to,...

CVE-2023-31446-Remote-Code-Execution

CVE-2023-31446-Remote-Code-Execution Repository contains description for CVE-2023-31446 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-31446 Vendor: Cassia Networks Product: Cassia Gateway Firmware Version: http:///bypass/config?type=sqs&keyId=&key=&queueUrl= Base...

CVE-2026-23550

CVE-2026-23550 Modular DS header'User-Agent'; $userAgentMatches = $userAgent && Str::is'ModularConnector/ Linux', $userAgent; $originQuery = $request-has'origin' && $request-get'origin' === 'mo'; $isFromQuery = $originQuery || $userAgentMatches && $request-has'type'; // When is wp-load.php reques...

cve-2024-51567-poc

cve-2024-51567-poc Simplified Description Vulnerability Overview ID : CVE-2024-51567 Type : Command Injection / CSRF Bypass Affected Versions : CyberPanel 2.3.6 and 2.3.7 unpatched Description : In the upgrademysqlstatus endpoint of CyberPanel, by bypassing the secMiddleware protection for POST...

CVE-2026-0920

Exploit Research: CVE-2026-0920 - LA-Studio Element Kit Backdoor Technical analysis and Proof of Concept PoC for the critical backdoor discovered in LA-Studio Element Kit for Elementor versions ≤ 1.5.6.3. This vulnerability allows unauthenticated administrative account creation. Vulnerability...

CVE-2026-4406

Gravity Forms = 2.9.28 — Unauthenticated Reflected Cross-Site Scripting via gformgetconfig formids Parameter Vulnerability Summary...

CVE-2026-4112

SonicWall SMA 8200v: Privilege Escalation via Cross-Parameter Blind SQL Injection Firmware: 12.5.0-02283 Platform Hotfix on 12.5.0-02002 Base SonicWall Advisory 1. Summary A post-authentication blind SQL injection vulnerability in the SonicWall SMA 8200v management console port 8443 allows any...

CVE-2023-6329

CVE-2023-6329 — Control iD iDSecure Authentication Bypass A Python proof-of-concept exploit for CVE-2023-6329 , an improper access control vulnerability in Control iD iDSecure versions 4.7.43.0 and below. The flaw allows an unauthenticated remote attacker to reconstruct valid login credentials by...

CVE-2021-45416

CVE-2021-45416 Reflected Cross-site scripting XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the searchterm parameter in the modules/Scheduling/Courses.php script. Vendor: francoisjacquet Vendor Website: https://www.rosariosis.org/ Affected Product: RosarioSIS...