CVE-2019-16724

Vulnerability Description File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler SEH based buffer overflow in an HTTP POST parameter. This exploit was tested on windows 7 Home. It will certainly break when on other...

ASUS-AiCloud-RCE

Origasus A Go program compiled with origasus.go, written for examining endpoints that can be associated with ASUS AiCloud / AsusWRT within the scope of authorized security testing or defense analysis e.g., your own device, a pentest lab environment. Important: The use of such software against...

CVE-2026-82329-PoC-Exploit

CVE‑2026‑82329 – JFrog Artifactory Auth Bypass Toolkit ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse A...

CVE-2021-21972

CVE-2021-21972 VMware vSphere Client Unauthorized File Upload to Remote Code Execution RCE The vSphere Web Client HTML5 is essentially an administrative interface that enables management of a vSphere installation. The vSphere Client provides an administrator with access to the key functions of...

Security Bulletin:Jackson-Databind Denial-of-Service Vulnerability in Versions 2.13.0 to 2.14.0

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if and only if the service reads deeply nested 1000s of levels JSON as...

CVE-2026-84429

A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessiv...

CVE-2026-18322

CVE-2026-18322 — Smart Popup by Supsystic Privilege Escalation Security research on CVE-2026-18322 , an unauthenticated privilege-escalation vulnerability in the WordPress plugin Smart Popup by Supsystic popup-by-supsystic. This repository contains a root-cause analysis derived from the upstream...

CVE-2020-7471

CVE-2020-7471 SQL injection via StringAgg delimeter input Setup: Run ./setup.sh for initial setup Open the docker image to initiate the database: docker exec -it containerid /bin/bash And run the following commands: python manage.py makemigrations vulapp python manage.py migrate Start the instanc...

CVE-2019-0211-exploit

CVE-2019-0211 — Apache HTTP Server Local Privilege Escalation CARPE DIEM Description CVE-2019-0211 is a local privilege escalation vulnerability affecting Apache HTTP Server between versions 2.4.17 and 2.4.38 using modprefork and modphp or PHP-FPM. The vulnerability allows an attacker with a shel...

CVE-2024-10914__POC

CVE-2024-10914 - Proof of Concept Exploit for command injection vulnerability in the /cgi-bin/accountmgr.cgi endpoint. This vulnerability allows arbitrary command execution on the affected system through unsanitized parameters. Vulnerability Description CVE-2024-10914 is a command injection...

CVE-2015-9251

CVE-2015-9251 [email protected] PoC for CVE-2015-9251 jQuery before 3.0.0. CVE-2015-9251 - PoC Exploit This repository contains a Proof of Concept PoC for the vulnerability CVE-2015-9251 in the jQuery library. The vulnerability allows a Cross-Site Scripting XSS attack through unsanitized JSO...

CVE-2020-13424

Exploit Title: Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion Authenticated Date: 2020-05-10 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Exploit-Db Author ID: 8763 Reference: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/ Vendor...

slot2

slot2 slot2: a two-stage UEFI GRUB2 bootkit that persists a pre-OS networked implant on Amazon Linux 2023 on AWS EC2 UEFI x8664. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/slot2 Summary slot2 is a bootkit for Amazon Linux 2023 on EC2. The AWS EC2 UEFI firmware load...

CVE-2026-95140

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create...

CVE-2026-105846

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

CVE-2026-104070

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

OnlyOffice-path-traversal

ONLYOFFICE Path Traversal Exploit CVE-2023-46988 📌 Overview This script exploits a path traversal vulnerability in ONLYOFFICE Document Server CVE-2023-46988 that allows unauthorized users to copy arbitrary files from the server. The vulnerability exists in the /example/editor endpoint, where the...

CVE-2019-9053-exploit

CVE-2019-9053 — Unauthenticated SQL Injection in CMS Made Simple Description CVE-2019-9053 is a time-based blind SQL injection vulnerability affecting CMS Made Simple versions ≤ 2.2.9. It does not require authentication. The vulnerable parameter is m1idlist in the News module moduleinterface.php...

CVE-2026-12416-CVE-2026-12417

CVE-2026-12416-CVE-2026-12417 Unauthenticated Account Takeover via Weak Password Reset Validation via 'resetuserid' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'resetactivationcode' Leading to Account Takeover CVE-2026-12417 & CVE-2026-12416 — Mass...

CVE-2023-49440

CVE-2023-49440-POC Exploit Title: AhnLab EPP ManagementCentralised Endpoint Security Management - Boolean-based-SQL-Injection SQL Injection that led to RCE Date: 16 July 2023 CVE : CVE-2023-49440 Vendor Homepage: https://www.ahnlab.com/en Software...