37882 matches found
CVE-2023-46615
CVE-2023-46615 KD Coming Soon = 1.7 - Unauthenticated PHP Object Injection via cetitle Description: The KD Coming Soon plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7 via deserialization of untrusted input cetitle in the vulnerable kdcemailer...
Follina_MSDT_CVE-2022-30190
Microsoft explains that โa remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker ca...
CVE-2026-54121-CertiGhost
CVE-2026-54121-CertiGhost This POC is the original POC code from https://github.com/aniqfakhrul/CVE-2026-54121/blob/main/certighost.py but with slight changes to use a computer object that we already controll instead of relying on creating a new computer that is generally limited through...
CVE-2025-32463-POC
CVE-2025-32463 โ Sudo chroot Privilege Escalation PoC This repository contains a proof-of-concept PoC exploit for CVE-2025-32463, a local privilege escalation vulnerability in sudo versions 1.9.14 through 1.9.17. The vulnerability allows a local unprivileged user to escalate privileges to root by...
CVE-2022-30190_EXP_PowerPoint
CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-30190 on PowerPoint. Modify the suffix of the file to 'zip' and unzip the file, you can edit \ppt\slides\rels\slide1.xml.rels and replace to your vps ip:port like this, then compress them as the same way and change the suffix to 'ppsx'. The...
CVE-2018-15982
CVE-2018-15982 Flash sources for CVE-2018-15982 used by NK this is a dump of a fully weaponized activex obj used by NK https://threatpost.com/adobe-patches-zero-day-vulnerability-in-flash-player/139629/ Payloads are in Class 6 and 7...
CVE-2022-21661
๐ก๏ธ CVE-2022-21661 A Proof-of-Concept PoC exploit written in Python for CVE-2022-21661, which is a critical vulnerability in WordPress that allows an unauthenticated attacker to perform an object injection attack , which under certain conditions can lead to Remote Code Execution RCE. This...
postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module
A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...
cve-2019-5420-POC
Rails ActiveSupport Exploit cve-2019-5420 POC consider this to chain CVE-2019-5418! Pairs lovely with CVE-2019-5418! POC Screenshot ๐จ Warning This repository contains a proof-of-concept PoC exploit demonstrating remote code execution RCE in Ruby on Rails applications via...
Exploit-CVE-2025-68613
Exploit-CVE-2025-68613 Security Advisory: Critical Remote Code Execution Vulnerability in n8n CVE-2025-68613 A critical vulnerability has been identified in the n8n workflow automation tool that allows for arbitrary code execution. Authenticated users with permissions to create or edit workflows...
jsPDF-Object-Injection
CVE-2026-25755 jsPDF ๆฒ็ฎฑ็ป่ฟ็ผบ้ทๅฏผ่ดๅฏน่ฑกๆณจๅ ฅ ๆฆ่ฟฐ ๅจ jsPDF๏ผไธ็งๅนฟๆณ็จไบๅฎขๆท็ซฏๅบ็จไธญ็ๆ PDF ๆๆกฃ็ JavaScript ๅบ๏ผไธญๅ็ฐไบไธไธชไธฅ้็ PDF ๅฏน่ฑกๆณจๅ ฅๆผๆด๏ผCVE-2026-25755๏ผใ่ฏฅๆผๆดๅญๅจไบ addJS ๅฝๆฐไธญ๏ผๆปๅป่ ๅฏ้่ฟไธๅฝ็่พๅ ฅๆธ ็็ป่ฟ AcroJS ๆฒ็ฎฑ้ๅถ๏ผๆณจๅ ฅไปปๆ PDF ๅฏน่ฑกใ ๆ นๆฌๅๅ jsPDF ไธญ็ addJS ๅฝๆฐๅ ่ฎธๅผๅ่ ๅจ็ๆ็ PDF ๆไปถไธญๅตๅ ฅ JavaScript ไปฃ็ ใ็ถ่๏ผๅจ 4.2.0 ็ๆฌไนๅ๏ผ่ฏฅๅฝๆฐๆช่ฝๆญฃ็กฎๆธ ็ๅ ๅซ็นๆฎ PDF ่ฏญๆณๅญ็ฌฆ็็จๆท่พๅ ฅใ ๆๅๆปๅป็ไปฃ็ ๏ผ4.2.0 ไนๅ๏ผ...
CVE-2026-33229
CVE-2026-33229 โ ้่ฟ Apache Velocity ๆฒ็ฎฑ็ป่ฟๅฎ็ฐ XWiki RCE XWiki Platform ไธญ็ไธไธช่ฟ็จไปฃ็ ๆง่กๆผๆด๏ผๅ ่ฎธๅ ทๆ่ๆฌๆ้็ๅทฒ่ฎค่ฏ็จๆทๅฎๅ จ็ป่ฟ Apache Velocity ๆฒ็ฎฑโโๆ ้ Java ๅๅฐโโ้่ฟ้ๅ Velocity ไธไธๆไธญๅทฒ้ขๅ ๅฎไพๅ็ๅฏน่ฑกๅฎ็ฐใ ๐ ๅฎๆดๆๆฏ็ป่๏ผ youssefazefzaf.com/posts/cve ่ฏฆๆ ๅญๆฎต| ๅผ ---|--- CVE ID| CVE-2026-33229 ๅๅฝฑๅไบงๅ| XWiki Platform ็ปไปถ| Velocity ๅฎๆธฒๆๅจ๏ผ้กต้ขๆ ้ขๅๆฐ ๆ้ๆ้| ๅทฒ่ฎค...
CVE-2026-33154
Dynaconf SSTI ๆผๆดๆฅๅ ๆ่ฆ Dynaconf ็ฑไบ @Jinja ่งฃๆๅจไธญ็ไธๅฎๅ จๆจกๆฟๆฑๅผ๏ผๅญๅจๆๅก็ซฏๆจกๆฟๆณจๅ ฅ๏ผSSTI๏ผๆผๆดใๅฝๅฎ่ฃ ไบjinja2 ๅ ๆถ๏ผDynaconf ไผๅจๆ ๆฒ็ฎฑ็ฏๅขไธๆฑๅผๅตๅ ฅๅจ้ ็ฝฎๅผไธญ็ๆจกๆฟ่กจ่พพๅผใ ๅฆๆๆปๅป่ ่ฝๅคๅฝฑๅ้ ็ฝฎๆบ๏ผไพๅฆ๏ผ ็ฏๅขๅ้ .env ๆไปถ ๅฎนๅจ็ฏๅข้ ็ฝฎ CI/CD ๅฏ้ฅ ...ไปไปฌๅฐฑๅฏไปฅๅจไธปๆบ็ณป็ปไธๆง่กไปปๆๆไฝ็ณป็ปๅฝไปค ใๆญคๅค๏ผ@Format ่งฃๆๅจๅ ่ฎธๅฏน่ฑกๅพ้ๅ๏ผ่ฟๅฏ่ฝไผๆด้ฒๆๆ็่ฟ่กๆถๅฏน่ฑกๅ็ฏๅขๅ้ใ ่ฏฆ็ปไฟกๆฏ ่ฏฅๆผๆด็ไบง็ๆฏๅ ไธบ Dynaconf ็ๅญ็ฌฆไธฒ่งฃๆๅจ็ผบไน้ๅฝ็ๅฎๅ จ่พน็ใ 1. @Jinja ่งฃๆๅจ @Jinja...
CVE-2026-35045-PoC
CVE-2026-35045 โ Tandoor Recipes ไธญ็ๅฏน่ฑก็บงๆๆๅคฑๆๆผๆด ๆ่ฆ Tandoor Recipes v2.6.1 ไธญ็ PUT /api/recipe/batchupdate/ ็ซฏ็นๅ ่ฎธ Space ๅ ็ไปปไฝๅทฒ่ฎค่ฏ็จๆท ไฟฎๆน่ฏฅ Space ไธญ็ไปปๆ้ฃ่ฐฑโโๅ ๆฌๅ ถไป็จๆทๆฅๆ็็งๆ้ฃ่ฐฑใ่ฟๅฎๅ จ็ป่ฟไบๆๆๆ ๅๅ้ฃ่ฐฑ็ซฏ็นไธๅผบๅถๆง่ก็ๅฏน่ฑก็บงๆๆๆฃๆฅใ ๆ นๆฌๅๅ ๆฏ Django REST Framework ็ไธไธช่กไธบ็ผบ้ท ๏ผdetail=False ๅ่กจๆไฝๆฐธ่ฟไธไผ่ฐ็จ hasobjectpermission๏ผๅชไผ่ฐ็จ haspermissionใๆฅ่ฏข้ไป ้่ฟ...
CVE-2026-89063
The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is vulnerable to an Insecure Direct Object Reference (IDOR) via the conversation_id parameter in all versions up to and including 28.1 . Due to missing validation on this user-controlled key, unauthenticated attackers ...
CVE-2024-11318
CVE-2024-11318 IDOR - AbsysNet 2.3.1 User Hijacking DISCLAIMER This tool is designed to help identify and exploit whether an application is vulnerable to this specific CVE-2024-11318. It is intended for use by cybersecurity professionals, researchers, and penetration testers to assess security in...
CVE-2019-13272
CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 root@kitploit: In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local...
vulnerable-bsr-lab-CVE-2023-6933
CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions โค1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...
CVE-2026-92217
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...
EUVD-2026-80080
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...