CVE-Reports

!CVE-Reportshttps://socialify.git.ci/d0ctorsec/CVE-Reports/im...

Security-Writeups

🔐 Security Writeups Welcome! This repository contains my pers...

Exploit for CVE-2026-53359

cve-id ⚡ Simple Usage Use this project only in safe and...

Inspectra

Inspectra 🛡️ Web Security Configuration Auditor Inspe...

Exploit for Integer Underflow (Wrap or Wraparound) in Microsoft

CVE-2026-42980 Public Disclosure This repository contains the...

Exploit for Unrestricted Upload of File with Dangerous Type in Ollyo Sp_Page_Builder

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE...

Exploit for Improper Neutralization of Special Elements in Data Query Logic in Budibase

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injec...

sui-txblock-deser-poc

@mysten/sui.js TransactionBlock Deserialization PoC Summar...

📄 Phoenix Contact TC Router 5004T-5G EU 1.06.18 Authenticated Command Injection

Proof of concept for an authenticated command injection vulnerability in certain Phoenix Contact TC Routers such as 5004T-5G EU with firmware versions 1.06.18 and below...

📄 Proofpoint Messaging Security Gateway 8.18.4.73 Remote Code Execution

Proofpoint Messaging Security Gateway version 8.18.4.73 has a remote code execution vulnerability in Euwebutils.pm. About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code...

📄 MODX 3.2.1 Missing Secure Flag

MODX version 3.2.1 is missing the secure flag setting on its cookie. Titles: MODX.3.2.1 TLS cookie without secure flag set - COOKIE PHPSESSID HIJACK Author: nu11secur1ty Date: 7/7/2026 Vendor: https://modx.com/ Software:...

📄 Proofpoint Messaging Security Gateway 8.18.4.73 Remote Code Execution

Proofpoint Messaging Security Gateway version 8.18.4.73 has a remote code execution vulnerability that can be leveraged via a simple curl. About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586...

📄 Samba Print Command Injection

This is a command injection exploit for the Samba print spooler subsystem. ================================================================================================================================== | Title : Samba Print Spooler Subsystem Command Injection Assessment Tool Review | | Author...

📄 Discuz! X5.0 Authentication Bypass

Discuz! X5.0 suffers from an authentication bypass vulnerability. Exploit Title: Discuz! X5.0 - Authentication Bypass CVE: CVE-2026-49952 Date: 2026-06-26 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/mbanyamer Autho...

📄 Flowise 3.1.3 Arbitrary Code Execution

Flowise version 3.1.3 suffers from an arbitrary code execution vulnerability. On Windows, the Custom MCP stdio environment variable validation uses case-sensitive comparison. Supplying "nodeoptions" bypasses the NODEOPTIONS denylist and allows arbitrary code execution via --require. Exploit Title...

📄 Pulpy 0.1.1-Beta Sandbox Bypass

Pulpy versions 0.1.1-Beta and below suffer from a filesystem sandbox bypass vulnerability. Exploit Title: Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass Google Dork: N/A Date: 2026-06-19 Exploit Author: Onur BILICI @basekill Vendor Homepage: https://github.com/enesgkky/pulpy Software Link:...

📄 OPNsense XPATH Injection

OPNsense suffers from a stored XPATH injection vulnerability that allows any user with just ca manager/certificate manager permissions to leak any secret key/any value in config.xml, thus achieving privilege escalation and potentially remote code execution. Patched in version 26.1.10. SUMMARY: a...

iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter

Exploit Title: iOS Bluetooth PAN - Zero-Cost Ethernet Gateway USB Port 62078 Date: 2026-06-23 Exploit Author: Fares Dahoumane Silent Killer Vendor Homepage: https://www.apple.com/ Software Link: https://www.apple.com/ios/ Version: iOS 17 and later Tested on: iPhone 14 Pro iOS 17.5.1, macOS Ventur...

ProtonVPN v4.4.1 - Unquoted Service Path

Exploit Title: ProtonVPN v4.4.1 - Unquoted Service Path Date: 2026-06-22 Exploit Author: Milad Karimi Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Vendor Homepage: https://protonvpn.com/ Software Link: https://protonvpn.com/ Version: 4.4.1 Tested on: Windo...

📄 WordPress KeepInMind Dashboard 0.8.4.2 Cross Site Scripting

WordPress KeepInMind Dashboard versions 0.8.4.2 and below suffer from a persistent cross site scripting vulnerability. Exploit Title: KeepInMind 0.8.4.2 - Stored XSS Date: 2026-06-12 Exploit Author: Pavan N Vendor Homepage: https://wordpress.org/plugins/keepinmind-dashboard-notes/ Software Link:...