pymap

pymap — SQL injection discovery & exploitation toolkit Two co...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Yordam-Kütüphane-Otomasyonunda-Çoklu-HTML-Enjeksiyonu CVE-2026-77818 · CVSS 3.1 6.1 Orta · Siber Güvenlik Başkanlığı · Yayımlanma 2026-09-04 · TR-26-1011 Durum: Zafiyetler v22.2 sürümünde giderilmiştir. Etkilenen kurulumların v22.2 veya üzerine yükseltilmesi gerekmektedir. Genel Bakış Yordam...

CMS-made-simple-sqli-python3

CMS-made-simple-sqli-python3 CMS Made Simple 2.2.10 - SQL Injection rewritten for python3, CVE-2019-9053 I found it problematic to run this exploit on kali linux, since python2 doesn't have termcolor, so with very few brackets I made it working with python3. All credit goes to:...

CVE-2023-45878-POC

CVE-2023-45878-POC CVE-2023-45878 poc for gibbon LMS on xampp windows. Upload a webshell called shell.php for command injection. For reverse shell uploads a powershell reverse shell ps1 script called shell.ps1 which is uploaded to the target machine using the shell.php. Requirments Python3 Reques...

cve-2018-1207

cve-2018-1207 Exploit iDRAC 7 & 8 firmware 2.52.52.52 Description Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection Description A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cglmaili parameter, where the...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

CVE-2023-1454

CVE-2023-1454 CVE-2023-1454 Vulnerability Detection Script This article is for reference only. Do not use the technical materials and tools in this article to intrude into any computer system without authorization. The direct or indirect consequences and losses caused by the information provided ...

CVE-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...

CVE-2025-51591-Pandoc-SSRF-POC

CVE-2025-51591 Pandoc SSRF POC A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Install Pandoc https://pandoc.org/installing.html Payload Example ⚠️ replace iframe url to your own OAST...

CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Unauthenticated SQL Injection Description: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user suppli...

CVE-2020-14295

CVE-2020-14295 CVE-2020-14295 proof of concept. The original post can be found at exploit-db. Install requirements python3 -m pip install -r requirements.txt Usage $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti 1.2.12 - SQL Injection / Remote Code...

Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Summary The task-position endpoint authorizes only the task side of the write: TaskPosition.CanUpdate delegates to Task.CanUpdate write access to the task's own project and the request body's projectviewid is never validated to belong to the task's project, nor is any access to that view required...

CVE-2026-7654

CVE-2026-7654 CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX Endpoint Module SQL Injection → Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...

CVE-2026-108259

The headless content management system Tina contains a code injection vulnerability in versions prior to 3.0.0 . The @tinacms/cli component fails to sanitize Git branch names retrieved from environment variables like VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD. These raw values are interpolated...

EUVD-2026-95987

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...

CVE-2026-108259 Tina: Code injection via unescaped Git branch name in generated client source

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...

CVE-2026-108259 Tina: Code injection via unescaped Git branch name in generated client source

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...