CVE-2026-93976: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93978: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Password leads to sql injection. The attack can be executed remotely. The exploit is publicly available...

CVE-2026-93979: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipulation of the argument Password results in sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-92253: Improper Link Resolution Before File Access

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file pa...

CVE-2026-94016: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drugrecommender/Admin/addsymptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. T...

CVE-2026-94048: Improper Privilege Management

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...

CVE-2026-94043: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzerdeps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name:...

CVE-2026-94047: Improper Privilege Management

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of...

CVE-2026-94004: Improper Control of Generation of Code

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytagjs.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2026-94015: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drugrecommender/Admin/edituser.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available an...

drupalgeddon2-cve-lab

Laboratorio Drupalgeddon2 CVE-2018-7600 Este repositorio es un paquete de objetivo reutilizable para la ejecución de Drupalgeddon2. Sentinel reprodujo CVE-2018-7600 el 2026-08-27 contra Drupal core 7.57 con SQLite y PHP 7.4. El exploit es la ruta de matriz de renderizado AJAX de dos solicitudes d...

CVE-2026-11645

CVE-2026-11645 - V8 en Google Chrome anterior a Ejecución Remota de Código Uso Rápido root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Notas de Explotación Gravedad: ALTA CVSS: 8.8 Impacto: Confidencialidad, Integridad, Disponibilidad Publicado:...

List-CVE-2025-2026

CVE-2025-69412 - KDE messagelib anterior a 25.11.90 ignora los errores SSL para threatMatches:find en la API de búsqueda de Google Safe Browsing también conocida como API de phishing, lo que podría permitir ... 2. CVE-2025-69413 - En Gitea anterior a 1.25.2, /api/v1/user tiene diferentes...

rustinel v1.8.0-rc.1

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Bring your detection content, monitor your endpoints, and send alerts to the...

CVE-Lib

CVE-Lib — CVE + PoC Library 2026 Local, offline-searchable...

CVE-2026-93992

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling...

CVE-2026-93956

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93955

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argumen...

CVE-2022-21661-PoC

CVE-2022-21661-PoC Un PoC en Python para CVE-2022-21661, inspirado en el PoC en Go de z92g Instalación root@kitploit: pip3 install -r requirements.txt Uso root@kitploit: usage: main.py -h -u URL -f FILE Identify CEV-2022-21661 in Wordpress instances. options: -h, --help show this help message and...