VivisectION

VivisectION Emulation-Driven Reversing Toolset VivisectION is the cross-section of GUI Reversing, Emulation and Debugging, with an emphasis on using Emulation and other powerful Vivisect toys to aid in Reverse Engineering and Vulnerability Research. Among other things, VivisectION aka Ion is a...

pollyscan

Pollyscan-CVE-2024-38526-Vulnerability Scanner It is a lightweight security tool designed to detect CVE-2024-38526, the Polyfill.io Supply Chain Attack. It scans web dependencies for malicious injections & automated detection. Installation git clone https://github.com/padayali-JD/pollyscan.git cd...

CVE-2023-22621-POC

CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting Email Templates affecting Strapi Versions return strapi.config.get'plugin.email'; ; const send = async options = return strapi.plugin'email'.provider.sendoptions; ; / fill subject, text and html using lodash template @param object...

riscv-isa-sim

Spike RISC-V ISA Simulator Acerca de Spike, el simulador de ISA RISC-V, implementa un modelo funcional de uno o más harts RISC-V. Recibe su nombre del clavo de oro golden spike utilizado para celebrar la finalización del ferrocarril transcontinental de EE. UU. Spike soporta las siguientes...

riscv-isa-sim

Spike RISC-V ISA Simulator About Spike, the RISC-V ISA Simulator, implements a functional model of one or more RISC-V harts. It is named after the golden spike used to celebrate the completion of the US transcontinental railway. Spike supports the following RISC-V ISA features: RV32I and RV64I ba...

CVE-2026-90551 WWBN AVideo Missing Authorization via video_from_program API

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the videofromprogram API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owne...

CVE-2026-90551

WWBN AVideo (through commit c3edcc274) has a missing authorization flaw in its video_from_program API endpoint, which fails to validate playlist ownership before returning results. An unauthenticated network attacker can query the endpoint to enumerate private playlist names, owner information, a...

CVE-2024-1441

This repo is made to reproduce fuzzing and analysis process of discovering CVE-2024-1441 11 used commands root@kitploit: 2 commands to install packages apt-get update apt-get install 1 git command git clone 4 build commands meson ninja make cargo build 1 command to set environment values export 1...

EUVD-2026-76869

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the videofromprogram API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owne...

CVE-2026-90550

WWBN AVideo (through commit c3edcc27) is affected by a missing authorization vulnerability in the PlayerSkins mediaSession.json.php endpoint. The endpoint fails to verify user authorization before returning video metadata, allowing unauthenticated attackers to supply a video ID parameter and retr...

CVE-2026-90550 WWBN AVideo Missing Authorization via mediaSession.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected vide...

EUVD-2026-76868

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected vide...

CVE-2026-90549 WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner...

CVE-2026-90549

WWBN AVideo , a PHP-based video platform, is vulnerable to missing authorization on the videosAndroid.json.php endpoint in versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can send a simple GET request to the endpoint and retrieve metadata of password-pr...

EUVD-2026-76867

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner...

CVE-2026-90539

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 has a missing authentication flaw in the plugin/TopMenu/menuItems.json.php endpoint. An unauthenticated attacker can send a POST request with a menuId parameter to read inactive admin menu items, retrieving hidden menu item URLs ...

EUVD-2026-76857

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

CVE-2026-90539 WWBN AVideo Missing Authentication via menuItems.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499-root-KernelSU A local privilege escalation ada...

CVE-2025-50867

A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization. Vulnerability Type : SQL Injection Vendor of Product :...