278739 matches found
📄 ZTE ZXHN H188A V6 Authentication Bypass
Unauthenticated requests to the root path of ZTE ZXHN H188A V6 firmware can reach pre-login wizard handlers and disclose WLAN PSKs, SSIDs, and PPPoE usernames. The leaked Wi-Fi password is also the default administrator password after uppercasing, resulting in full authentication bypass. -----BEG...
D-Link DSL2600U - 'rom-0' Admin Password Disclosure
Exploit Title: D-Link DSL2600U - 'rom-0' Admin Password Disclosure Date: 2026-05-02 Exploit Author: Amir Hossein Jamshidi Vendor Homepage: https://www.dlink.com Version: DSL-2600U Tested on: ubuntu CVE : N/A Firmware Version: v1.08 from routersploit.libs.lzs.lzs import LZSDecompress import reques...
Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
Exploit Title: Apache HTTP Server 2.4.66 - 'modhttp2' Double-Free Denial of Service Google Dork: intext:"Apache/2.4.66" "HTTP/2" Date: 2026-05-06 Exploit Author: xeloxa https://github.com/xeloxa/ Vendor Homepage: https://httpd.apache.org/ Software Link:...
Linux Kernel 6.8 - Local Privilege Escalation
Exploit Title: Linux Kernel 5.4 - 6.8 - Local Privilege Escalation Google Dork: N/A Date: 2026-04-30 Exploit Author: Long Fong Chan https://github.com/iss4cf0ng Vendor Homepage: https://www.kernel.org/ Software Link: https://git.kernel.org/ Version: Linux Kernel 5.4 - 6.8 unpatched Tested on:...
📄 ZTE ZXHN Router Denial of Service
The CGILua post.lua parser used in ZTE ZXHN routers does not enforce an upper bound on the body size of application/x-www-form-urlencoded POST requests. An unauthenticated attacker can crash or freeze the router's web management service by sending a single HTTP POST request with an oversized body...
📄 WordPress Supsystic Contact Form 1.7.36 Server-Side Template Injection
This Metasploit module is for WordPress Supsystic Contact Form plugin versions 1.7.36 and below. The plugin suffers from a server-side template injection vulnerability that allows for remote code execution. This module requires Metasploit: https://metasploit.com/download Current source:...
Grav CMS 2.0.0-beta.2 - Remote Code Execution
Exploit Title: Grav CMS 'onPluginsInitialized', 0; public function onPluginsInitialized: void $shellpath = GRAVROOT . '/shell.php'; if !fileexists$shellpath fileputcontents$shellpath, ''; ---------------------- 2. Compress t...
cPanel - CRLF Injection
ExploitTitle: cPanel 11.40 - CRLF Injection Author: nu11secur1tyAI Date: 2026-04-30 Vendor: cPanel, L.L.C. Software: cPanel & WHM cpsrvd Reference: CVE-2026-41940 / watchTowr-2026-01 Description: A critical authentication bypass vulnerability exists in the cPanel/WHM cpsrvd daemon due to improper...
-authencesn-poc
authencesn-poc Mrowl made by c0redev https://unitdev.run...
Exploit for Improper Access Control in Fiberhome Hg6145F1_Firmware
CVE-2025-63353 PoC - FiberHome HG6145F1 Predictable Default Wi...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 — React Server Components Pre-Auth RCE "React2...
exploit-lab
Threadbare — Exploit-Development Training Lab Introduction...
Exploit for Incorrect Implementation of Authentication Algorithm in Google Android
popping a calc bash am start -n com.sec.android.app.popupcalc...
Exploit for CVE-2026-33137
CVE-2026-33137 XWiki Platform - Unauthenticated XAR Import...
MS16-032-Cobalt-Strike-LPE-BOF
MS16-032 Beacon Object File BOF A Cobalt Strike Beacon Obje...
Exploit for CVE-2012-1803
CVE-2012-1803 Critical vulnerability in Siemens Rugge...
Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce
CosmicSting CVE-2024-34102 Exploit Suite Complete exploit s...
Exploit for CVE-2026-33712
CVE-2026-33712 - Typebot Unauthenticated SSRF Description...