gitlab_rce_cve-2022-2884

gitlabrcecve-2022-2884 This is a Python3 program that exploits GitLab authenticated RCE vulnerability known as CVE-2022-2884. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool responsibly. I do not take responsibility for the...

exploit-CVE-2016-10034

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

Moderate: Red Hat Security Advisory: compat-openssl11 security update

An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Important: Red Hat Security Advisory: compat-openssl10 security update

An update for compat-openssl10 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

domains-from-csp

domains-from-csp A Python script to parse domain names from CSP header A script to extract domain names from Content Security PolicyCSP headers The output is print to stdout for now Demo Screenshots 3rd party package dependency requests click Setup Clone this repo $ git clone...

assets-from-spf

assets-from-spf A Python script to parse netblocks & domain names from SPFSender Policy Framework DNS record For every parsed asset, the script will also find and print Autonomous System NumberASN details For now, the output is printed in JSON format only Demo Screenshots 3rd party package...

CVE-2023-31703

CVE-2023-31703 — Reflected XSS in eScan Management Console Overview CVE ID: CVE-2023-31703 Vulnerability Type: Reflected Cross-Site Scripting XSS Affected Product: Microworld Technologies eScan Management Console Affected Version: 14.0.1400.2281 Severity: Medium Discovered By: Sahil Ojha Disclosu...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Insecure Direct Object Reference IDOR vulnerability in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Product: SOGo Affected Versions: v5.6.0 Impact: Insecure Direct Object Reference IDOR vulnerability → Allows the user to send emails on behalf of another user. Summar...

CVE-2020-7247-reproducer

CVE-2020-7247 OpenSMTPD Información Este repositorio contiene los archivos necesarios para construir una imagen de Docker que contiene un entorno vulnerable de OpenSMTPD 6.6.1p1. La vulnerabilidad permite a un atacante ejecutar comandos arbitrarios a través de una sesión SMTP especialmente...

CVE-2026-88877-PoC-pwnVader

CVE-2026-88877 — Traefik v3.7.0–v3.7.11 — Authentication bypass via from-to-www-redirect Author: pwnVader · License: MIT repository root | ---|--- Component| Traefik Kubernetes ingress-nginx provider, providers.kubernetesingressnginx Type| CWE-639 — Authorization bypass through user-controlled ke...

cve-2019-9193

CVE-2019-9193 • CVE-2019-9193 Vulnerability PostgreSQL has a vulnerability that allows arbitrary code execution within the DB's operating system via the “COPY TO / FROM PROGRAM” feature. The attack vector involves users who are “SuperUser” or belong to the “pgexecuteserverprogram” group...

CVE-2026-96671

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96671

The fifu.app Featured Image from URL WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 6.0.7 . This flaw allows an attacker to perform unauthorized actions by tricking a victim's browser into making unintended requests. The severit...

EUVD-2026-95611

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96671 WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

DIY-CVE-2026-42945-POC

Ubuntu 22.04 + nginx 1.30.0 Docker Runtime This environment builds nginx 1.30.0 from source on Ubuntu 22.04 for local HTTP testing. PHP-FPM is configured directly in the Dockerfile because nginx.conf forwards PHP requests to /tmp/php-cgi-80.sock. Run docker compose up -d --build The compose file...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

S3-from-csp

S3-from-csp Extracts all S3 Buckets from CSP report headers and then tests for file upload vulns Install go install github.com/RandomRobbieBF/S3-from-csp@latest Run s3fromcsp file.txt...

CLEANSTART-2026-SG10675 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...