CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ Then view post made by the author to trigger the XSS Video POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Stored XSS via Tile HTML Field PoC This repository documents a proof-of-concept PoC for a stored cross-site scripting XSS vulnerability affecting the iOS mobile application of URVE Smart Office. Due to insufficiently implemented input validation, attacker-controlled...

CVE-2020-7247-POC

Foreword Key facts about the exploit Installing the vulnerable server Configuration Environment disclaimers Exploit Manual Exploitation Scripted Exploitation Foreword This repository should serve as a base to set up and exploit CVE-2020-7247 in a controlled and private environment. All of the...

CVE-2025-45778

CVE-2025-45778 CVE-2025-45778: Authenticated Stored XSS. An authenticated stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary JavaScript or HTML code via injecting a crafted payload into the "Description" text field when...

auto-cve-2022-44268.sh

auto-cve-2022-44268 Automating exploitation of CVE-2022-44268 ImageMagick Arbitrary File Read Original finding: https://www.metabaseq.com/imagemagick-zero-days/ PoC Repository: https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC Description ImageMagick will interpret the...

boko

boko Application Hijack Scanner for macOS boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities for application executables, as well as scripts an application may use that have the potential to be backdoored. The tool...

Netgear-ssl-vpn-20211222-CVE-2022-29383

Netgear-ssl-vpn-20211222 CVE-2022-29383 NETGEAR ProSafe SSL VPN SQL injection vulnerability exists in scgi-bin/platform.cgi Firmware version： FVS336Gv2 - FVS336Gv3 sqlmap command SQL Injection Vulnerability : USERDBDomains.Domainname...

CVE-2025-14221

Description 1. CVE-2025-14221 2. Discoverer: Fatma Trabelsi 3. Vendor of Product: SourceCodester 4. Affected Product: Online Banking System 1.0 POC A Stored Cross-Site Scripting XSS vulnerability exists in the User Profile Update functionality of the application. The application fails to properly...

CVE-2022-24124

Preface Casdoor is a centralized single sign-on SSO authentication platform based on OAuth 2.0/OIDC ID CVE ID: CVE-2022-24124 CNPD ID: CNPD-202201-7304 Affected Versions Severity: High 7.5 HIGH POC/EXP: Publicly available Casdoor Casdoor 1.13.1 // All versions before 1.13.1 are affected...

CVE-2025-56379

CVE-2025-56379 — Stored Cross-Site Scripting XSS in ERPNext 15.67.0 / Frappe 15.72.4 📌 Summary A stored Cross‑Site Scripting XSS vulnerability exists in the Blog module of ERPNext v15.67.0 / Frappe v15.72.4. An authenticated user who can create or edit blog posts may inject crafted HTML/JavaScrip...

CVE-2023-28467

MyBB 1.8.33 User CP email persistent XSS root@kitploit: - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com Solution Upgrade MyBB version 1.8.34 or higher...

jwt-key-id-injector

Inyector de ID de Clave JWT Script simple de Python para verificar una vulnerabilidad hipotética de JWT. Supongamos que hay una aplicación que utiliza tokens JWT firmados con el algoritmo HS256. Un token de ejemplo se ve así: root@kitploit:...

bof

BOF BOF Boiboite Opener Framework is a testing framework for field protocols implementations and devices. It is a Python 3.6+ library that provides means to send, receive, create, parse and manipulate frames from supported protocols. The library currently provides discovery and extended testing...

CVE-2021-24545

CVE-2021-24545 This is an XSS vulnerability discovered in a plugin that is no longer distributed as a plugin. WordPress Plugin HTML Author Bio description XSS This vulnerability is caused by improper validation of the description parameter in /wp-admin/profile.php. A remote attacker can exploit...

CVE-2026-82730

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

CVE-2026-74837

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-77856

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

EUVD-2026-68929

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-74837

CVE-2026-74837 is an unauthenticated denial-of-service vulnerability in ash-project ash_typescript (versions 0.1.0 before 0.18.0 ). The root cause lies in AshTypescript.FieldFormatter.convert_to_field_atom/2, which mints a permanent BEAM atom for every client-supplied RPC field name via String.to...

CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...