Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

Gotenberg - Command Injection

Gotenberg 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request. id: CVE-2026-42589 info: name: Gotenberg - Command Injection...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Kan <= 0.5.4 - Server-Side Request Forgery

Kan, an open-source project management tool Trello alternative, versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled url query parameter straight to a server-side fetch...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

ResourceSpace - Metadata Export

In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value. id: CVE-2022-31260 info: name: ResourceSpace - Metadata Export author: ritikchaddha severity: medium description: | In Montala ResourceSpace...

Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'updatemetadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

NTLMRecon

Overview NTLMRecon is a Golang version of the original NTLMRecon utility written by Sachin Kamath AKA pwnfoo. NTLMRecon can be leveraged to perform brute forcing against a targeted webserver to identify common application endpoints supporting NTLM authentication. This includes endpoints such as t...

Metaforge

Metaforge "An OSINT tool that analyzes metadata and creates dynamic reports" https://chriswmorris.github.io/Metaforge/ Senior Design Project 2019 - By Chris Morris and Collin Mockbee A Python3 Application for Unix-based Operating Systems Note: Metaforge requires at least python version 3.5 to wor...

automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job --...

CVE-2024-1071-Docker

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Go to the project : cd...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL Injection CVE-2025-67644 is a SQL Injection vulnerability CWE-89 in the langgraph-checkpoint-sqlite package part of LangGraph / LangChain ecosystem. It allows an attacker to inject arbitrary SQL via unsanitized metadata filter keys passed to th...

CVE-2025-66034-htb-ctf

CVE-2025-66034-htb-ctf VariaType Variable Font Generator Exploit This repository contains a specialized exploit for the VariaType machine on Hack The Box. The exploit leverages a vulnerability in how the fontTools library or the web application handles .designspace XML files and metadata...

automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job --...

CVE-2026-67229

RabbitMQ, a messaging and streaming broker, is vulnerable to a Denial of Service (DoS) condition in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The add_vhost/2 function calls the unsafe rabbit_data_coercion:atomize_keys/1 variant using binary_to_atom on the vhost metadata map. An...