278140 matches found
Exploit for SQL Injection in Wordpress
CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destruc...
📄 LightFTP Server 2.3.1 Race Condition
LightFTP version 2.3.1 contains a residual race condition in the workerthreadcleanup function of ftpserv.c. The control thread reads and acts on shared per-connection state, including the worker thread id it then passes to pthreadjoin/pthreadcancel, without holding the context-MTLock mutex that t...
📄 LiteLLM 1.83.6 Blind SQL Injection
A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...
📄 OpenCTI 7.260325.0 Authorization Bypass
A proof of concept exploit for an authorization bypass vulnerability in OpenCTI version 7.260325.0. The vulnerability affects OpenCTI versions prior to 7.260326.0 and allows a low-privileged authenticated user with the KNOWLEDGEKNUPDATE capability to bypass confidence-level and object-marking...
📄 OpenCATS Installer PHP Code Injection
This Metasploit module exploits an unauthenticated PHP code injection in the OpenCATS installer AJAX endpoint CVE-2026-27760. The databaseConnectivity action passes the user POST parameter directly to changeConfigSetting, which interpolates it into a define statement in config.php without any...
📄 FineAdmin.Mvc SQL Injection
A proof of concept exploit for a SQL injection vulnerability in FineAdmin.Mvc. Insufficient validation of the field and order parameters allows arbitrary SQL expressions to be injected into the ORDER BY clause, enabling error-based and time-based SQL injection against affected endpoints...
📄 ICS-Park Smart Park Management System 2.0 Privilege Escalation
A proof of concept exploit for a privilege escalation vulnerability in ICS-Park Smart Park Management System version 2.0. Missing authorization checks allow an authenticated low-privileged user to create a role containing arbitrary permissions, assign that role to their own account, and create ne...
📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
📄 ICS-Park Smart Park Management System 2.0 Cross Site Scripting
A proof of concept exploit for a cross site scripting vulnerability in ICS-Park Smart Park Management System version 2.0. An authenticated user can upload arbitrary HTML files because the upload whitelist permits .html and .htm extensions, resulting in stored cross site scripting when another use...
Exploit for CVE-2026-60004
CVE-2026-60004 - Gitea Once executed, the script will automa...
Exploit for CVE-2026-67620
CVE-2026-67620 — Flowise SSRF via incomplete cloud-metadata de...
Exploit for Race Condition in Openbsd Openssh
No d...
YayTune_PoC
YayTunePoC This is a repository dedicated to technical test...
Vulnerability-Assessment-Penetration-Testing-Engagement-X-Company
VAPT Report — Venus & Napping X Company Engagement Vulnerab...
Exploit for CVE-2026-59243
CVE-2026-59243 — Apache Airflow FAB Provider OAuth Auth Bypass...
Exploit for Use After Free in Linux Linux_Kernel
ghostlock-honor-aak GhostLock CVE-2026-43499 exploit adapte...
Exploit for CVE-2026-69243
CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request...
Exploit for Use After Free in Linux Linux_Kernel
GhostLock — OnePlus Locked Bootloader Jailbreak Kernel exploi...