CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2024-25292

RenderTune RCE A Proof-Of-Concept for CVE-2024-25292 vulnerability. A cross-site scripting XSS vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter. In this repository there is an example...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic 5.19.4, and 6.0.0 – 6.2.2 Fixed in:...

log4j-Scan-Burpsuite

log4j-Scan-Burpsuite Burpsuite detection plugin for Log4j vulnerability CVE-2021-44228 Includes ON/OFF switch, Filter, Send Features: Automatically replace request headers Automatically replace POST request application/json parameters Automatically replace POST request application/x-www-urlencode...

CVE-2023-1389

Description CVE-2023–1389 is an Unauthenticated Command Injection vulnerability in the TP-Link Archer AX21 WiFi router. A calllback in the country parameter uses the popen function, which is run as root, allowing the attacker to inject arbitrary values through GET or POST requests to the admin...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

cve-2019-15107

CVE-2019-15107 - Webmin Unauthenticated RCE Description This repository contains a proof-of-concept PoC exploit for CVE-2019-15107 affecting Webmin versions 1.890 through 1.920. The script exploits a backdoor in versions 1.890 through 1.920 that allows unauthenticated users to inject commands int...

cve-2000-0649

CVE-2000-0649 for Apache CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server from the Location parameter in the respose header. Official details are here: Rapid7: https://www.rapid7.com/db/modules/auxiliary/scanner/http/iisinternalip/ CV...

CVE-2023-27372

CVE-2023-27372 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS Reflected Cross-Site Scripting XSS Vulnerability Tiki CMS - 'page' Parameter Reflected Cross-Site Scripting XSS Vulnerability Disclaimer Intended only for educational, research, and defensive purposes. Unauthorized use against systems without permission is illegal. Summa...

CVE-2019-1663-Binary-Analysis

Binary Analysis of CVE-2019-1663 Author: Corentin Wolff Origin of the Vulnerability Source of the Vulnerability The vulnerability originates from the function 0x0002BF64, which misuses the strcpy function, making it prone to buffer overflow attacks. For clarity, this function has been renamed to...

overwrite

An easy & complete Flexible Field for Laravel Nova, perfect for repeated and flexible field groups. Quick start Here's a very condensed guide to get you started asap. See the full docs at https://whitecube.github.io/nova-flexible-content Install root@kitploit: composer require...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected. Tomcat versions before 9.0.1 Beta, 8.5.23, 8.0.47 a...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Unauthenticated SQL Injection Description The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2021-26084

CVE-2021-26084 Introduction This write-up provides an overview of CVE-2021-26084 - Confluence Server Webwork OGNL injection 1 that would allow an authenticated user to execute arbitrary code on a Confluence Server or Data Center instance. TL;DR Confluence Server / Data Center makes use of Webwork...

CVE-2026-30655

CVE-2026-30655 — SQL Injection in esiclivre password reset Summary A SQL injection vulnerability exists in the password reset endpoint of esiclivre. An unauthenticated attacker can inject SQL via the cpfcnpj POST parameter, potentially resulting in unauthorized access to sensitive information...

CVE-2023-46022-Code-Projects-Blood-Bank-1.0-OOB-SQL-Injection-Vulnerability

CVE-2023-46022-Code-Projects-Blood-Bank-1.0-OOB-SQL-Injection-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overview...

CVE-2025-34030-PoC

CVE-2025-34030 - sar2html 'plot' parameter RCE CVSS: 10.0 Critical Vulnerability: OS Command Injection Programming Language: PHP Exploit Code: Python References: https://nvd.nist.gov/vuln/detail/CVE-2025-34030 https://www.vulncheck.com/advisories/sar2html-command-injection Description sar2html...

CTT-ProxyLogon-RCE-v1.0---Convergent-Time-Theory-Enhanced-Microsoft-Exchange-Exploit

CTT-ProxyLogon-RCE-v1.0---Exploit de Microsoft Exchange mejorado con Teoría del Tiempo Convergente Un exploit avanzado para Microsoft Exchange Server CVE-2021-26855, CVE-2021-27065 mejorado con principios de la Teoría del Tiempo Convergente, logrando una calificación teórica casi perfecta mediant...