171184 matches found
Apache ShenYu Admin JWT - Authentication Bypass
Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. id: CVE-2021-37580 info: name: Apache ShenYu Admin JWT - Authentication Bypass author: pdteam severity: critical descriptio...
GeoServer WPS - Server Side Request Forgery
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service WPS specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request...
cPanel < 11.109.9999.116 - Cross-Site Scripting
An issue was discovered in cPanel before 11.109.9999.116. Cross Site Scripting can occur on the cpsrvd error page via an invalid webcall ID. id: CVE-2023-29489 info: name: cPanel 11.109.9999.116 - Cross-Site Scripting author: DhiyaneshDk,0xKayala severity: medium description: | An issue was...
XWiki - Open Redirect
XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0. id: CVE-2023-32068 info: name: XWiki - Open Redirect author:...
Vendure - Arbitrary File Read
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
Yaws 1.91 - Local File Inclusion
Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. id: CVE-2017-10974 info: name: Yaws 1.91 - Local File Inclusion author: 0xAkoko severity: high description: Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. impact: |...
FUEL CMS 1.4.1 - Remote Code Execution
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. id: CVE-2018-16763 info: name: FUEL CMS 1.4.1 - Remote Code Execution author: pikpikcu severity: critical description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/...
Roxy Fileman 1.4.5 - Unrestricted File Upload
Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. id: CVE-2018-20526 info: name: Roxy Fileman 1.4.5 -...
CVE-2026-32202
Zero-click forced authentication: viewing a folder with the crafted .lnk triggers UNC resolution during icon render, coercing the victim into an attacker-directed outbound connection that leaks and enables relay of their Net-NTLMv2 credentials. Emerged due to an incomplete patch of CVE-2026-21510...
cryptoquant-key-gen
CryptoQuant Breaker v1.6 — 2026 Unlock CryptoQuant Premium Features | Advanced Analytics & Real-Time Data Access Description CryptoQuant Breaker is a powerful patcher utility designed to bypass CryptoQuant's advanced analytics tier restrictions and real-time data limits. Get unlimited access to...
Detecting-the-patch-of-CVE-2018-1010
Detecting-the-patch-of-CVE-2018-1010 This C++ code developed on Visual Studio 2017. This program works with cmd's commands. In this program first, we check your operating system version and then according to Microsoft's notification checks whether you have installed the patch for CVE-2018-1010...
CVE-2026-41729
CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC This repository is a minimal reproduction PoC for CVE-2026-41729, as disclosed in the official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-41729/ Official title: Spring Data REST SpEL...
CVE-2024-38143
CVE-2024-38143 Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability Successful exploitation can lead to possible escalation to NT AUTHORITY\SYSTEM Background While on a client engagement, I had to test a physical laptop and for some reason, stumbled upon this article by Matthew...
Windows-Exploit-Suggester
DESCRIPTION This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins. It requires the...
CVE-2025-23061
CVE-2025-23061 - Mongoose Command Injection A proof of concept for the Command Injection vulnerability in Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 & CVE-2025-23061 Timeline November 7, 2024: Dat Phung identified a critical vulnerability in Mongoose and submitted a security report to Snyk...
debian-lenny-bash_3.2.52-cve-2014-6271
debian-lenny-bash3.2.52-cve-2014-6271 Debian Lenny Bash packages with cve-2014-6271 patches i386 and amd64 You can test the flaw by running: env x=' :;; echo vulnerable' bash -c "echo this is a test"...
magento2-template-filter-patch
Parche del Filtro de Plantillas de Magento 2 para CVE-2022-24086, CVE-2022-24087 Parche de Magento 2 para CVE-2022-24086, CVE-2022-24087. Corrige la vulnerabilidad RCE y los errores relacionados mediante un escape profundo de variables de plantilla. Si no puede actualizar Magento o no puede aplic...
CVE-2021-21985
CVE202121985 Description This script check the CVE-2021-21985 vulnerability and patch on vCenter Server. Requirements Python3 Python3 Standard Library Installation git clone https://github.com/mauricelambert/CVE202121985.git ./ Example To check IP 10.0.0.2, 10.0.0.3 and hostname vCenter3: python3...
trellix-tarslip-patch-bypass
trellix-tarslip-patch-bypass In 2023, Trellix announced 1 that they patched +61,000 open-source projects for CVE-2007-4559, an old path traversal vulnerability. Analyzing their patch, it's easy to notice that it can be bypassed using a symlink. Symlink path traversal is an old technique, and it h...