EUVD-2026-123774

Webmin through 2.670 contains a privilege escalation vulnerability in acl/savegroup.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules...

CVE-2026-126780

Webmin versions up to and including 2.670 are susceptible to a privilege escalation vulnerability within the acl/save_group.cgi component. The root cause is the improper handling of the mod parameter, which allows delegated administrators to submit arbitrary module lists. An attacker with access ...

EUVD-2026-123626

A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the...

CVE-2026-108558

A reflected cross-site scripting (XSS) vulnerability exists in the conversion-statistics pages of Revive Adserver version 6.0.8 and earlier. The root cause is an incorrect ownership check that validates the advertiser identifier instead of the supplied website identifier, which allows malicious w...

EUVD-2026-123583

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI whitelist RPC handler /usr/lib/lua/luci/data/whitelistplt.lua, where unsanitized user-supplied MAC addresses are concatenated into os.execute without validation, yielding root command execution via a...

CVE-2026-126723

The Rooxis RXR-12 Wi-Fi router is vulnerable to an authenticated command injection flaw in the LuCI white_list RPC handler located at /usr/lib/lua/luci/data/white_list_plt.lua. The root cause is the lack of validation for user-supplied MAC addresses , which are concatenated into os.execute() with...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

Google-Nest-Cam-Bug-Disclosures

Google-Nest-Cam-Bug-Disclosures Affected: Dropcam Pro, Nest Cam Indoor/Outdoor models Latest Build Affected: 205-600052 Partial Fixed Build: 205-600055 UPDATE The latest fw version 205-600055 does not fix the WiFi dissassociation vulnerability in the Dropcam Pro. If the supplied WiFi network does...

EUVD-2026-123404

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...

CVE-2018-16763

CVE-2018-16763 Analyzer CVE-2018-16763 Analyzer is a small Python project for analyzing CVE-2018-16763 against FUEL CMS targets. It focuses on checking whether a target appears vulnerable and on displaying command output in a cleaner, more readable way when the application response is noisy. This...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

CVE-2017-12617

updated version of https://github.com/cyberheartmi9 CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection Description A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cglmaili parameter, where the...

CVE-2022-41040-POC

CVE-2022-41040-POC CVE-2022-41040 - Server Side Request Forgery SSRF in Microsoft Exchange Server Manual exploiation 1. Replace COLLABHERE with your OOB domain - sed 's/COLLABHERE//g 2. Add payloads next to URLs you want to test - echo http://target.com|unfurl format %s://%d/ 3. Visit crafted URL...

CVE-2022-27434

CVE-2022-27434 UNIT4 TETA Mobile Edition 29HF13 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page. The vulnerability exist in the error page generated by the application in this case: while changing password. Adding quotation mark to...

joomla_CVE-2023-23752

joomlaCVE-2023-23752 Joomla - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are index.php in the root directory users access articles administrator/index.php in the root directory administrator management api/index.php in the ro...

CVE-2024-10914

POC - CVE-2024–10914- Command Injection Vulnerability in name parameter for D-Link NAS Overview A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiuseradd of the file...

CVE-2025-55575

smm-panel-sqliCVE-2025-55575 Time-based SQL Injection Detection for SMM Panel Overview This template detects a time-based SQL Injection vulnerability in the servicedetail parameter of the SMM Panel via HTTP POST requests to /ajaxdata. Exploitation can allow remote attackers to access sensitive da...

CVE-2023-49985

CVE-2023-49985 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "cname" parameter on "newclass" Description : A cross-site scripting XSS vulnerability in the component "newclass" of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts ...