CVE-2026-79843

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption...

CVE-2026-103508

P4 Search formerly Helix Search allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search...

CVE-2021-3129-Lab

CVE-2021-3129: Laravel Debug Mode RCE Lab Hands-on lab for exploiting CVE-2021-3129 - a critical Laravel vulnerability allowing unauthenticated file read and potential RCE. Quick Start Clone git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git cd CVE-2021-3129-Lab Build & Run dock...

CVE-2024-10586-Poc

Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - Authenticated Author+ Arbitrary File Read via Directory Traversal Description The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments...

CVE-2023-47529

CVE-2023-47529 Cloud Templates & Patterns collection = 1.2.2 - Sensitive Information Exposure via Log File Description: The Cloud Templates & Patterns collection plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.2 via a log file with a...

CVE-2020-11651

CVE-2020-11651 PoC for CVE-2020-11651 Requires Python3 tested on 3.8 python3.8 -m pip install pyzmq msgpack ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server IP or Host optional...

CVE-2024-5084

Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

CVE-2024-21626-PoC

CVE-2024-21626 Root cause & Proof of Concept How to use poc-autoplay? make install make uninstall 1. Root cause In runc versions ≤ 1.1.11, when opening the host's /sys/fs/cgroup directory to set cgroups, the file descriptor is left open for the container initialization process without closing it,...

EUVD-2026-102114

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2026-57155

OPNsense versions prior to 26.1.11 and 26.4.1p1 are vulnerable to Root Remote Code Execution (RCE) via an arbitrary file write in the Firewall Alias GeoIP importer . The root cause is an unvalidated CSV country_code value in the process_zip() and process_gzip() paths of src/opnsense/scripts/filte...

CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

CVE-2025-32118

🚀 CVE-2025-32118 - WordPress CMP Plugin RCE Exploit 🔍 Title: WordPress CMP – Coming Soon & Maintenance plugin = 4.1.13 - Remote Code Execution RCE 🗓️ Published: 2025-04-04 🔐 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type 📊 CVSS: 9.1 CRITICAL —...

jsPDF-Bulk-Detector-CVE-2025-68428-

🚨 jsPDF Bulk Detector – CVE-2025-68428 🚨 Asset-wide detection tool for identifying jsPDF usage related to CVE-2025-68428. Detection only — no exploitation. 🚨 Background A critical vulnerability was disclosed in the popular JavaScript PDF generation library jsPDF, tracked as CVE-2025-68428...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup pip3 install -r requirements.txt Run python3 app.py Attacker Connect to server Connect to server ...