CVE-2026-69097 GitPython before 3.1.53 Config Injection via Submodule Names

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

Exploit for CVE-2026-60004

CVE-2026-60004 — Gitea Diffpatch Git Hook RCE Bare Clone Hook In...

Exploit for Injection in Vm2_Project Vm2

Hack The Box — Codify Writeup !Difficultyhttps://img.shiel...

cyber-apocalypse-ctf-2026

Links Challenges | Catego...

Exploit for SQL Injection in Wordpress

wpsqli - WordPress SQLi Extractor CVE-2026-60137 A fast,...

Exploit for CVE-2026-17583

cve-id Donate Support the maintenance of this project wit...

Exploit for CVE-2026-60004

CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9...

sqli-xss-vulnerable-lab

SQL Injection ve Cross-Site Scripting XSS Laboratuvarı Za...

exploitarium

Statement This repo was incomplete when published. In regar...

cve-2026-poc-collection

CVE-2026 Proof-of-Concept PoC Collection Report Collectio...

Gitea <= 1.27.0 - Pre-Auth Remote Code Execution

Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GITDIR. An attacker with write access can execute arbitrary commands as the Gitea service account...

paseo-poc-repo-trust

paseo-poc-repo-trust — DEMO PoC repository ⚠️ This is a sec...

Exploit for NULL Pointer Dereference in Pgbouncer

--- CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserializ...

Exploit for CVE-2026-7777

--- CVE-2026-7777 – Rust Use‑After‑Free in Unsafe Web Server...

CVE-Poc_All_in_One

CVE Poc All in One 🛡️ This is a tool for searching, filtering...

Exploit for CVE-2026-2828

--- 4. CVE-2026-2828 – WebGPU Cross‑Origin Pixel Stealing vi...

Exploit for Improper Privilege Management in Google Chrome

--- 3. CVE-2026-9999 – Serverless Function Event Injection...

EUVD-2026-52481

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

CVE-2026-51190

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

PT-2026-67419

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create...