DEBIAN-CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

CVE-2020-15227

CVE-2020-15227 DISCLAIMER! I take no responsibility of using it in wild life environment so please do NOT do it. This thingy is just to demonstrate and for test things for sysadmins I made this exploit according to publishing a CVE of David Grudl The founder of Nette foundation as he did not solv...

CVE-2025-32434

CVE-2025-32434: PyTorch RCE Vulnerability - PoC What is CVE-2025-32434? CVE-2025-32434 is a critical Remote Code Execution RCE vulnerability in PyTorch, a widely used Python library for deep learning and neural networks. The Core Problem The vulnerability exists in the torch.load function, even...

CVE-2018-14665

CVE-2018-14665 0x00 Introduction Indian security researcher Narendra Shinde discovered a high-risk vulnerability CVE-2018-14665 in the X.Org Server package that allows a regular account to escalate privileges to root. It affects major Linux distributions including OpenBSD, Debian, Ubuntu, CentOS,...

CVE-2020-9380

PoC IPTV Smarters Exploit Usage python gld.py -u http://www.pirate-ilegal-tv.com/ -i Vulnerability file includes/ajax-control.php: ?php / @ PHP 5.6 @ Decoder version : 1.0.0.1 @ Release on : 24.03.2018 @ Website : http://EasyToYou.eu / sessionstart; if fileexists"functions.php" includeonce...

CVE-2024-1071-SQL-Injection

Proof of concept CVE-2024-1071: WordPress Vulnerability Exploited Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all...

CVE-2023-6063-PoC

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. $ python sqlmap.py --dbms=mysql -u "http://127.0.0.1/wp-login.php"...

CVE-2026-39200

CVE-2026-39200 — Reflected Cross-Site Scripting XSS in Toko Online RotI Summary A reflected Cross-Site Scripting XSS vulnerability was identified in the produk request parameter of the Toko Online RotI web application. The application fails to HTML-encode user-supplied input before reflecting it...

CVE-2020-35667-PoC

CVE-2020-35667-PoC Overview DISCLAIMER The vulnerable behaviour illustrated below was verified empirically from decompiled, patched artifacts, which tries to resemble the original vulnerability inferred with an heuristic approach, since the original vulnerable plugin release is no longer availabl...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

CVE-2024-33911

The School Management 10.3.4 - Post-Authenticated SQL Injection Exploit Title: The School Management 10.3.4 - Post-Authenticated SQL Injection Date: 29 April, 2024 Exploit Author: Ivan Spiridonov xbz0n Vendor Homepage: https://theschool-management.com Version: 10.3.4 Tested on: Ubuntu 22.04 CVE:...

CVE-2025-66947

CVE-2025-66947 Time Based Blind SQL Injection in krishanmuraiji SMS v1.0 ⏱️ Visual comparison: normal response vs 6s delayed response 🔍 Summary TL;DR: A GET parameter in an admin module allows time-based SQL injection via response delays. A 𝗧𝗶𝗺𝗲 𝗯𝗮𝘀𝗲𝗱 𝗯𝗹𝗶𝗻𝗱 𝗦𝗤𝗟 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 exists in...

CVE-2026-58457

CVE-2026-58457 - Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater !WARNING This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets. Running or hosting this code m...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

CVE-2017-7921-Writeup-2026

CVE-2017-7921 — Hikvision IP Camera / DVR / NVR Improper Authentication — Privilege Escalation via Crafted Query Parameter | ---|--- CVE ID| CVE-2017-7921 Vulnerability Class| CWE-287: Improper Authentication CVSS v3.0 Base Score| 10.0 Critical — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v2.0 Scor...

CVE-2020-17530

What's this This is a Simple test Project for S2-061 which can be used to analysis the detail of this vulnerability. How to use Step 1:Use IDEA import this project Step 2:setup tomcat Server Step 3:Use browser access...

cve-2017-5638

CVE-2017-5638 PoC Code in Python | DORK: ext:action Example PoC Code for CVE-2017-5638 | Apache Struts Exploit | DORK: ext:action USAGE: python struts.py https://victim.site dir The initial Python Script that was Posted didn't correctly format the Content-Type Header. I recoded the Content Type...

VMware-CVE-2022-22954

VMware CVE-2022-22954 Workspace ONE Access Freemarker Server-side Template Injection POC for Vmware CVE-2022-22954 Use this one line GET request!! This will execute cat /etc/passwd...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injection Unauthenticated JSON/NoSQL operator injection in Budibase. Any anonymous visitor of a published Budibase app that exposes a PUBLIC query backed by a document datasource MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST wi...