CVE-2024-51430

CVE-2024-51430 Vulnerability Type Cross-Site Scripting XSS Description Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component Vendor of...

CVE-2016-10993

CVE-2016-10993 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://themesinfo.com/scoreme-wordpress-theme-design-496 Proof of Concept PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E Refrensi...

CVE-2024-2387

CVE-2024-2387 Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms = 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integrationid Description The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets an...

CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - reflected Cross-Site Scripting XSS Description: A reflected XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code Steps to exploit: 1- Login to the CMS and Navigate to the delete...

CVE-2024-33453

CVE-2024-33453 Sensitive Data Exposure via Object Level Access Control in esp-idf Description A Buffer Overflow vulnerability in the esp-idf framework version 5.1, used by some Schoolbox products, allows a remote attacker to obtain sensitive information through improper object-level access contro...

CVE-2024-12209

CVE-2024-12209 WP Umbrella: Update Backup Restore & Monitoring = 2.17.0 - Unauthenticated Local File Inclusion Description The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename'...

CVE-2024-7854

CVE-2024-7854 Woo Inquiry = 0.1 - Unauthenticated SQL Injection Description: The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the...

CVE-2024-49379

Proof of Concept PoC for CVE-2024-49379 This repository contains a Python-based Proof of Concept PoC for a critical vulnerability identified in UmbrelOS. The vulnerability allows for Cross-Site Scripting XSS, which can escalate to Remote Code Execution RCE under specific conditions. Overview CVE ...

SmartAsset-SQLinj-CVE-2020-26525

SmartAsset-SQLinj-CVE-2020-26525 Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. Smart Asset - version 2020.7 CVE-2020-26525 ========================== HTTP Request: GET /API/api/Asset?assetCode=XXX-08-X-01-06-01&...

CVE-2026-0594-ListSiteContributors-Plugin-Exploit

CVE-2026-0594-ListSiteContributors-Plugin-Exploit 🛡️ Description CVE-2026-0594 is a critical Reflected Cross-Site Scripting XSS vulnerability found in the List Site Contributors WordPress plugin. This exploit automates the discovery of vulnerable endpoints via the WordPress REST API wp-json and...

CVE-2022-36537-EXPLOIT

CVE-2022-36537 Summary R1Soft Server Backup Manager uses the ZK framework as the main framework. Its security requires all Web3 project parties to pay more attention to the security vulnerabilities of various Web3 infrastructures and patch them in time to avoid potential security risks and digita...

CVE-2025-57529

CPAS-bug CPAS audit management information system has SQL injection vulnerability Beijing YouDataSum Technology Co., Ltd. domain: http://youdatasum.com info CVE-ID: CVE-2025-57529 affected version: findArchiveReportByDah@RequestParamvalue = "pageNum", defaultValue = "0" int pageNum,...

CVE-2024-34102

CVE-2024-34102 Usage python3 CVE-2024-34102.py -h optional arguments: -h, --help show this help message and exit -u URL, --url URL Target URL -ip IP, --ip IP Your IP address -p PORT, --port PORT Port for HTTP server -f FILE, --file FILE Path to the file to be included in the POC...

CVE-2023-33538-msf

CVE-2023-33538 – TP-Link TL-WR940N/841N Command Injection Metasploit module This Metasploit auxiliary module targets an authenticated command injection vulnerability in TP-Link TL-WR940N V2/V4 and TL-WR841N V8/V10 routers. The issue lies in the vulnerable ssid1 parameter used in WlanNetworkRpm.ht...

CVE-2022-26134

CVE-2022-26134 Use: exploit.py url command...

CVE-2025-5287

CVE-2025-5287 PoC Unauthenticated SQL Injection exploit for WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-5287 , targeting a vulnerability in the WordPress Likes and Dislikes Plugin ≤ 1.0.0. The vulnerability allows...

CVE-2021-35042

CVE-2021-35042 SQL injection via QuerySet.orderby untrusted input Setup: Start the instances using: docker-compose up Now open the following URL to load sample data: http://localhost:8000/vulapp/setup Then go to the vulnerable page at: http://localhost:8000/vulapp/ Exploit the parameter at:...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - HTML Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A HTML injection vulnerability exists in the Online Event Booking and Reservation System version 2.3.0. An attacker can leverage this vulnerability...

CVE-2025-68722

CVE-2025-68722: Axigen WebAdmin CSRF Vulnerability Summary Critical state-changing actions in the Axigen WebAdmin interface are accessible via GET requests. While the h token protects against direct CSRF, the application processes queued requests via the s breadcrumb parameter immediately after a...

CVE-2024-1561

CVE-2024-1561 PoC Script This is a Proof of Concept PoC script for CVE-2024-1561. Check the full writeup for the CVE here: https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338 Affected Version: Gradio 4.12.0 This was fixed in this PR https://github.com/gradio-app/gradio/pull/6884 and w...