CVE-2024-33111

CVE-2024-33111 D-Link DIR-845L routers version 1.01KRb03 and below are vulnerable to Cross Site Scripting XSS via /htdocs/webinc/js/bscsmsinbox.php. Vulnerable Component /htdocs/webinc/js/bscsmsinbox.php Technical Details The vulnerability is due to the lack of filtering in the parameter...

CVE-2025-54589

CVE-2025-54589 – Copyparty Reflected XSS Author: Byte Reaper Description : This repository provides a Proof-of-Concept PoC and simple exploit for CVE-2025-54589 , a reflected Cross-Site Scripting XSS vulnerability in Copyparty ≤ 1.18.6. By injecting crafted JavaScript payloads into the filter...

CVE-2025-10046

CVE-2025-10046 - ELEX WooCommerce Google Shopping Author: Byte Reaper Description CVE-2025-10046 is a SQL injection vulnerability in the ELEX WooCommerce Google Shopping Product Feed plugin for WordPress, versions 1.4.3 and earlier. The issue resides in the includes/elex-manage-feed-ajax.php file...

CVE-2026-115497

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-115497 Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-115497

The Music Store WordPress eCommerce plugin is vulnerable to Directory Traversal in all versions up to and including 1.4.7 . The flaw exists in the 'f' parameter , allowing unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. Successful explo...

CVE-2024-31835

CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...

CVE-2020-15399

Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection Date: 2020-06-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://joomsky.com/ Software Link: https://joomsky.com/products/js-jobs-pro.html Change Log Update :...

cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure

CVE-2026-34474: ZTE H298A / H108N Secret Leak via ETHCheat Technical breakdown of CVE-2026-34474, where an unauthenticated ETHCheat=1 request causes affected ZTE ZXHN H298A 1.1 and H108N 2.6 routers to return the live administrator password, ESSID, and WLAN PSK in the response markup. Summary The...

CVE-2026-114620

A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery SSRF by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies ...

EUVD-2026-108546

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory...

PT-2026-122120

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

PT-2026-122129

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery strips Solr local-parameter syntax !... from user-supplied query strings before they reach Solr. Its regex can be bypassed by...

PT-2026-122135

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...

cve-2025-6907

CVE‑2025‑6907 SQLi Exploit Tool File: exploit.c Author: Byte Reaper Target Service: CODEPROJECT Type: SQL Injection 🔎 Overview This is a standalone C-based SQL Injection exploit targeting the CVE‑2025‑6907 vulnerability in the CODEPROJECT service. It combines multiple advanced techniques: Automat...

CVE-2020-27368

CVE-2020-27368 TOTOLINK-A702R-V1.0.0-B20161227.1023 Directory Indexing Vulnerability Description Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter. Additional Information Remediation disabling...

cve-2022-33891

CVE-2022-33891 Apache Spark Shell Command Injection Vulnerability A Python POC for exploiting the Apache Spark Shell Command Injection vulnerability. I saw some other POCs out there but they looked mega sus. This one is clean and simple. I did not discover this exploit/vulnerability. I just wante...

CVE-2026-105265

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory...

CVE-2026-105265

The Kiloview E3 NDI Encoder is affected by a path traversal vulnerability (CWE-22) within its time zone parameter . Due to improper validation of user input, an authenticated user may cause the /etc/localtime file to point to a location outside the intended zoneinfo directory . The vulnerability ...

CVE-2026-105265 Kiloview E3 NDI Encoder Path Traversal

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory...