PT-2026-86221

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...

PT-2026-85387

A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used...

PT-2026-85529

Name of the Vulnerable Software and Affected Versions valkey-io valkey versions prior to 9.0.5 valkey-io valkey versions prior to 9.1.1 Description A remote out-of-bounds read exists in the Slot Migration component within the createSlotImportJob function of the src/cluster migrateslots.c file. Th...

Linux kernel IPv6 VTI Buffer Overflow

The vulnerability in the vti6tnllookup function within net/ipv6/ip6vti.c, which is part of the Linux kernel’s IPv6 implementation, stems from improper validation of unsafe input values. Exploitation of this vulnerability enables a remote attacker to compromise the confidentiality, integrity, and...

CVE-2026-85378

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...

CVE-2026-85224

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85208

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-Exploits

一个收集各种CVE漏洞的PoC（概念验证）或Exploit（漏洞利用）工具的仓库。旨在为安全研究、渗透测试提供参考和便利。...

apollo-x-ultimate

APOLLO-X ULTIMATE v1 WordPress Exploit Framework - The Dig...

CVE-2026-85207 itsourcecode Online Medicine Delivery System index.php cross site scripting

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-85207 itsourcecode Online Medicine Delivery System index.php cross site scripting

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-85186

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to...

EUVD-2026-70555

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to...

Root-My-Device v0.0.7

Root My Device A fork of BuSung-dev/Root-My-Galaxy, under the Apache License 2.0 — see LICENSE and Credits. Root My Device is a one-click installer for explicitly supported firmware builds. The application itself is kept separate from device offsets, native exploit payloads, and KernelSU build...

CVE-2026-85138

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2026-85138

SeaCMS versions up to 13.6 contain a SQL injection vulnerability in the WeChat Module (file weixin/index.php). The root cause lies in the addslashes function, where improper handling of the Content argument allows remote, unauthenticated attackers to inject SQL. The attack vector is network-based...

EUVD-2026-70534

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2026-85137 SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

EUVD-2026-70519

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...