CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...

CVE-2019-10758

CVE-2019-10758 PoC Setup docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js cURL exploit curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data 'document=this.constructor.constructor"return...

CVE-2024-36991-Tool

CVE-2024-36991-Tool This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and saves them locally for further analysis. The script is modular, allowing users to target specific file categories e.g...

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

Ivanti Endpoint Manager - Authentication Bypass

Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...

CVE-2023-23752

CVE-2023-23752 Joomla! Unauthorized Access Vulnerability POC: /api/index.php/v1/config/application?public=true Vulnerability Analysis https://xz.aliyun.com/t/12175...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695

The MultiVendorX WordPress plugin (through version 5.0.19 ) is vulnerable to an incorrect authorization flaw (CWE-863) within its settings REST endpoint. Attackers possessing the store_owner role can exploit this by sending POST requests to /wp-json/multivendorx/v1/settings. Because the endpoint ...

EUVD-2026-96698

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2021-21975

CVE-2021-21975 VMware vRealize Operations Manager API Server Side Request Forgery SSRF vRealize Operations vROps is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments while unifying public cloud...

CVE-2026-72550-poc

CVE-2026-72550 — Friendica Unauthenticated SQL Injection Unauthenticated stacked-query SQL injection in the photos endpoint in Friendica allows any visitor to run arbitrary SQL. Field| Value ---|--- CVE ID| CVE-2026-72550 Product| Friendica self-hosted federated social network Affected| =...

CVE-2022-1388-POC

CVE-2022-1388 Poc by PsychoSec Improved POC for CVE-2022-1388 that affects multiple F5 products. This is an improved version of Horizon3's Proof of Concept for CVE-2022-1388: https://github.com/horizon3ai/CVE-2022-1388 This version contains multiple improvements as well as an interactive shell to...

CVE-2024-10924

CVE-2024-10924 Exploit - WordPress Really Simple SSL Plugin 2FA Bypass Overview This repository contains an exploit for CVE-2024-10924 , a vulnerability in the Really Simple SSL plugin for WordPress. It allows an attacker to bypass Two-Factor Authentication 2FA onboarding and gain unauthorized...

PT-2026-110352

A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection...

PT-2026-110028

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to WPForms versions prior to 1.0.4 Description The add-on lacks authorization and Cross-Site Request Forgery CSRF checks when updating options via a REST endpoint. Additionally, it fails to verify if the option being updated...

PT-2026-110029

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept Description pocwptot.py is a proof‑of‑concept PoC to exploit a time‑based blind SQL injection vulnerability on the WordPress REST API batch endpoint, and perform an escalation chain up to Remote Code Execution RCE...

CVE-2026-50979

CVE-2026-50979: Ejecución Remota de Código Autenticada en oPanel Resumen CVE ID: CVE-2026-50979 Producto: oPanel Versiones Afectadas: v1.19.50 y anteriores Tipo de Vulnerabilidad: Inyección de Comandos Autenticada / Ejecución Remota de Código RCE Componente Vulnerable: punto final /advanced/curl...