EUVD-2026-100875

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

UBUNTU-CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

CVE-2023-40933-PoC

CVE-2023-40933 The sqlmap payload to exploit CVE-2023-40933 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=updatebannermessagesettings&id=3&token=curl -ksX...

CVE-2026-46449

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

CVE-2026-110455

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-101926

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...

cve-2024-43425

CVE-2024-43425 Firmware info: Application name: Moodle Build version: moodle-4.4.1 Affected versions: 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 and earlier unsupported versions Download link: moodle-4.4.1 Description and Impact Attackers with permission to create or modify questions...

CVE-2026-88899

CVE-2026-88899 - Knowns 0.30.0 Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem Overview An improper authorization and header-spoofing vulnerability was reported regarding Knowns' reverse proxy for an embedded OpenCode AI agent daemon...

palo-alto-panos-cve-2024-0012

CVE-2024-0012 and CVE-2024-9474 Authentication Bypass in the Management Web Interface PAN-SA-2024-0015 and Authenticated Command Injection in Palo Alto PAN-OS See our blog post for technical details Affected Versions TBD Exploit authors This exploit was written by Sonny of watchTowr @watchtowrcyb...

CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...

CVE-2023-29084

CVE-2023-29084 Command injection in ManageEngine ADManager Plus Poc POST /api/json/admin/saveServerSettings HTTP/1.1 Host: 10.10.10.99:8080 Content-Length: 183 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

CVE-2021-22911

Updated exploit for CVE-2021-22911 Rocket.Chat 3.12.1 - NoSQL Injection to RCE Unauthenticated original credits to : https://www.exploit-db.com/exploits/50108 Setup Create python virtual environment and install deps $ python -m venv venv $ source venv/bin/activate $ pip install requests oathtool...

EUVD-2026-100816

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

CVE-2026-110455

The UniFi Protect AI Key is vulnerable to an Improper Input Validation flaw. A malicious actor with network access could exploit this under specific conditions to perform a Command Injection on the device. No specific remediation information or exploit details are provided in the documents.

CVE-2026-110455

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

EUVD-2026-100814

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-106931

SiteGuard Server Edition versions 2.20 through 8.00 Update4 contain an OS command injection vulnerability within the statistics feature, which is enabled by default. A local attacker with low-privileged account access can exploit this flaw to execute arbitrary commands with root or SYSTEM privile...