CVE-2024-55271

Gym Management System CVE-2024-55271 A GYM management system built using PHP and MySQL. Auditor Shoaib Alam - LinkedIn Profile Description CSRF Vulnerability in Profile Update Section A Cross-Site Request Forgery CSRF vulnerability has been identified in the Gym Management System. This issue is...

poc_salesforce_lightning

PoC for Salesforce lightning Academic purposes Only. This tool dumps the data of Salesforce object through Aura lightning endpoint with the guest privilege. 雑なコードだけど許してくれい Requirement Python3 Usage $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a AURACONTEXT -r...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC & Reproduce This repository contains Proof-of-Concept PoC exploit code and instructions to reproduce the Local File Inclusion LFI vulnerability in MLflow, identified as CVE-2023-1177. Vulnerability Information: CVE ID: CVE-2023-1177 Vulnerability Type: Local File...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — Inyección SQL en el Módulo Endpoint de FreePBX → Ejecución Remota de Código Resumen FreePBX es la interfaz web de código abierto para Asterisk PBX, ampliamente implementada en entornos de telefonía empresarial. El módulo Endpoint Manager expone un manejador AJAX en /admin/ajax.ph...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Proof of concept Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ The python script abuses the upload function that is availible unauthenticated at /admin/files-upload/ The script locally creates a bin folder and a file named...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Exploit RCE de Pterodactyl Panel HTB Temporada 10 - Writeup de la Máquina Pterodactyl Resumen Objetivo: Máquina Pterodactyl HTB Dificultad Media CVE: CVE-2025-49132 Severidad: Crítica CVSS 9.8 Tipo de Ataque: Ejecución Remota de Código No Autenticada Afectado: Pterodactyl Panel...

CVE-2026-12392

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerable a falsificación de solicitud del lado del servidor Carga útil : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHER...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040

UTMStack versions before 11.2.16 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the IdentityProviderService.validateMetadataUrl() function. Authenticated attackers can exploit the POST/PUT /api/identity-providers endpoint because the application fails to validate the...

EUVD-2026-91792

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-39987_POC

PoC — CVE-2026-39987 · Marimo Pre-Auth RCE CVSS 4.0: 9.3 Critical · AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H Affects: marimo 2 calls to validateauth. terminal.py - 0 @requires, 0 validateauth. -- the flaw. The AuthBackend middleware protects HTTP and the /ws websocket, but /terminal/ws accepts the...

jsherp-user-info-idor

jshERP /user/info IDOR — VulDB submission package This repository contains a standalone VulDB-style advisory for an authenticated insecure direct object reference in jshERP. Product: jshERP Tested commit: ad6cf886dd4e0676723060a25d361c703dc56bc0 3.6-SNAPSHOT, GitHub master HEAD on 2026-09-04...

CVE-2026-12392

An information exposure vulnerability exists in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 . An unauthenticated attacker can retrieve the RPC secret in plaintext via the vendor data metadata endpoint . This is specifically possible if a target machine was deployed wi...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

EUVD-2026-91775

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

alibi

alibi Cross-check the views of your attack surface and find the endpoints that cannot corroborate each other. An endpoint should be able to account for itself. It is in the code, so a contract should describe it. It is in the contract, so something should implement it. It takes real traffic, so i...

CVE-2025-49493

Akamai CloudTest XXE Exploit CVE-2025-49493 Overview This is a Python-based exploit for CVE-2025-49493 , which affects Akamai CloudTest versions before 60 2025.06.02 12988. The vulnerability allows for XML External Entity XXE injection through the SOAP service endpoint. Vulnerability Details CVE ...