CVE-2024-50492

🚨 CVE-2024-50492 - ScottCart 🔥 Exploit Script for ScottCart 🧑‍💻 By Nxploit – Khaled Alenazi 📌 Description The ScottCart plugin for WordPress versions ≤ 1.1 is vulnerable to Remote Code Execution RCE. This allows unauthenticated attackers to execute arbitrary PHP functions on the server through a...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...

Linux Distros Unpatched Vulnerability : CVE-2026-106429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This ca...

PT-2026-109616

Name of the Vulnerable Software and Affected Versions Divi Plus versions prior to 2.4.1 Description The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function SVGAnimatorController::index permissi...

FreePBX-CVE-2025-57819-CVE-2025-61678

FreePBX-CVE-2025-57819-CVE-2025-61678 Chains CVE-2025-57819 stacked query SQL injection and CVE-2025-61678 authenticated file upload in FreePBX Endpoint Manager to achieve Remote Code Execution RCE. For educational use only. References:...

cve-2026-39987

cve-2026-39987 Installation • Usage • Examples I'm just trying out Go :D Btw: CVE-2026-39987 PoC: Marimo:PORT/terminal/ws REDACTED@REDACTED:$ uname -a Linux ... REDACTED@REDACTED:$ exit exit INF:normalclose websocket: close 1000 normal: Terminal session ended Custom Command -c: cve-2026-39987 -t...

CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are...

CVE-2025-3248

CVE-2025-3248 Introduction Langflow versions prior to 1.3.0 are susceptible to unauthenticated code injection in the /api/v1/validate/code endpoint via Python exec function. This exploit establishes a reverse shell connection abusing this vulnerability. Usage Configuration git clone...

CVE-2023-7028

CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulnerability Overview This repository contains an exploit for CVE-2023-7028 , a critical vulnerability in GitLab that allows an attacker to abuse the password reset functionality and take over accounts, including administrator accounts...

cve-2025-29927

CVE-2025-29927 1. go to /api/flag 2. add x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware as header 3. see response...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Overview CVE-2026-33017 is an unauthenticated Remote Code Execution RCE vulnerability in Langflow versions This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this too...

CVE-2025-3248

CVE-2025-3248 — Langflow AI Remote Code Execution Unauthenticated Author: 0xgh057r3c0n Description This exploit targets a critical unauthenticated RCE vulnerability CVE-2025-3248 in Langflow AI. The vulnerability allows an attacker to execute arbitrary system commands on the target server via the...

CVE-2024-55271

Gym Management System CVE-2024-55271 A GYM management system built using PHP and MySQL. Auditor Shoaib Alam - LinkedIn Profile Description CSRF Vulnerability in Profile Update Section A Cross-Site Request Forgery CSRF vulnerability has been identified in the Gym Management System. This issue is...

poc_salesforce_lightning

PoC for Salesforce lightning Academic purposes Only. This tool dumps the data of Salesforce object through Aura lightning endpoint with the guest privilege. 雑なコードだけど許してくれい Requirement Python3 Usage $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a AURACONTEXT -r...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC e Riproduzione Questo repository contiene il codice Proof-of-Concept PoC e le istruzioni per riprodurre la vulnerabilità Local File Inclusion LFI in MLflow, identificata come CVE-2023-1177. Informazioni sulla vulnerabilità: CVE ID: CVE-2023-1177 Tipo di vulnerabilità:...

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/taskassignees.go lines 306-344...

EUVD-2026-78644

Vikunja: Unbounded nested task-filter recursion permits API process termination...

EUVD-2026-78651

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project...

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Summary The task-position endpoint authorizes only the task side of the write: TaskPosition.CanUpdate delegates to Task.CanUpdate write access to the task's own project and the request body's projectviewid is never validated to belong to the task's project, nor is any access to that view required...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX Endpoint Module SQL Injection → Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...