PT-2026-7609

WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface...

PT-2026-7610

GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the event title parameter. Attackers can exploit the CreateEvent.php endpoint by sending crafted POST requests with XSS payloads to execute arbitrary...

PT-2026-7729

Name of the Vulnerable Software and Affected Versions manga-image-translator versions beta-0.3 and prior Description The software contains an unsafe deserialization issue that could allow unauthenticated remote code execution. The application’s API endpoints, /simple execute/method and...

VOID

VOID ██╗ ██╗ ██████╗ ██╗██████╗ ██║ ██║██╔═══██╗██║█...

CVE-2020-37159 Cuckoo Clock 5.0 - Buffer Overflow

Parallaxis Cuckoo Clock 5.0 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory registers in the alarm scheduling feature. Attackers can craft a malicious payload exceeding 260 bytes to overwrite EIP and EBP, enabling shellcode execution...

XSS-Scanner

XSS-Scanner This is a Cross Site Scripting Vulnerability scann...

OESA-2026-1278 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in...

OESA-2026-1277 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in...

Exploit for CVE-2025-70886

CVE-2025-70886 A Proof of Concept PoC exploit f...

New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan

In January 2026, Microsoft Defender Experts identified a new evolution in the ongoing ClickFix campaign. This updated tactic deliberately crashes victims’ browsers and then attempts to lure users into executing malicious commands under the pretext of restoring normal functionality. This variant...

CVE-2020-37125

Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download a...

EUVD-2020-31021

Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download a...

CVE-2020-37125

The CVE-2020-37125 entry describes a remote code execution vulnerability in Edimax EW-7438RPn-v3 Mini 1.27. Affected component is the device firmware; the root cause is command injection in the /goform/mp endpoint that can be exploited by unauthenticated attackers sending crafted POST requests to...

sql-injection

SQL Injection Payloads List SQL Injection Payloads List...

CVE-2026-25532 ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS Wi-Fi Protected Setup Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during...

Cockpit CMS 0.13.0 Multi-Endpoint Injection Scanner

Cockpit CMS version 0.13.0 multi-endpoint injection scanner. This tool is a defensive security scanner designed to safely assess web application endpoints for potential input-validation and injection weaknesses without executing any commands. It sends non-executable canary payloads through...

CVE-2020-37085

VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through the Thrift protocol. Attackers can exploit the vulnerability by sending a long string to the sendsay method, causing the server to become...

EUVD-2020-30991

VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through the Thrift protocol. Attackers can exploit the vulnerability by sending a long string to the sendsay method, causing the server to become...

CVE-2020-37085

VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through the Thrift protocol. Attackers can exploit the vulnerability by sending a long string to the sendsay method, causing the server to become...

CVE-2020-37085 VirtualTablet Server 3.0.2 - Denial of Service (PoC)

VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through the Thrift protocol. Attackers can exploit the vulnerability by sending a long string to the sendsay method, causing the server to become...