POC-CVE-2024-38820

CVE-2024-38820 Proof of Concept Overview This project demonstrates CVE-2024-38820 , a vulnerability in Spring Framework's DataBinder that allows bypassing disallowedFields protection due to locale-dependent case conversion issues. Vulnerability Details CVE ID : CVE-2024-38820 Affected Component :...

HTB-Pterodactyl-RCE-CVE-2025-49132

Pterodactyl Panel Locale RCE CVE-2025-49132 — Educational PoC -6f42c1 For authorized testing and defensive learning only. This repository is intended for controlled lab environments e.g., CTF/HTB-style setups where you own the target or haveexplicit written permission to test it. Context This...

UBUNTU-CVE-2026-61637

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to manipulate the backend to redirect the user to...

CVE-2026-61637

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to manipulate the backend to redirect the user to...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2025-49132

CVE-2025-49132 Proof of Concept PoC This repository contains a Proof of Concept PoC for CVE-2025-49132, a critical unauthenticated remote code execution RCE vulnerability in Pterodactyl Panel versions prior to 1.11.11. Vulnerability Details CVE ID : CVE-2025-49132 Severity : 10.0 Critical -...

CVE-2025-49132-Pterodactyl-Panel-RCE

CVE-2025-49132 — Pterodactyl Panel Security Research & Educational Analysis Overview This project documents research related to CVE-2025-49132 , a vulnerability affecting the Pterodactyl Panel. Purpose: Security research, education, defensive awareness Use only in controlled environments Does not...

CVE-2026-61637

The monitoring platform Icinga Web 2 is vulnerable to an open redirect on the login page in versions prior to 2.12.7 and 2.13.1 . An attacker can craft a malicious URL that, when accessed by an authenticated user (or one capable of authenticating), allows the attacker to manipulate the backend to...

CVE-2026-61637 Icinga Web 2: Open redirect on login page, under certain circumstances

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to manipulate the backend to redirect the user to...

CVE-2026-61637 Icinga Web 2: Open redirect on login page, under certain circumstances

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to manipulate the backend to redirect the user to...

CVE-2024-4577

PHP-CGI Windows Platform Remote Code Execution Vulnerability CVE-2024-4577 Introduction PHP is an acronym for Hypertext Preprocessor. It is now a widely used open-source scripting language that is particularly suitable for web development and embedding in HTML, and is very simple to use. CGI, whi...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2026-61637: Icinga icingaweb2: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to manipulate the backend to redirect the user to...

VulnCheck KEV: CVE-2026-119155

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-119155

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-119155 wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-119155 wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

EUVD-2026-119033

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-119155

The wpForo Forum plugin for WordPress (versions up to and including 3.2.2 ) is vulnerable to a time-based SQL Injection . The root cause is insufficient escaping and a lack of sufficient preparation on the 'href[locale]' parameter in existing SQL queries. This flaw allows unauthenticated attacker...

CVE-2026-119155: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all…

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...