MAL-2024-2878 Malicious code in poc-test-package (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2303 Malicious code in epc-menu-header-poc (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dependency-poc-for-testing-only-aswfsfghsssbx (npm)

--- -= Per source details. Do not edit below this line.=-...

U.S. Dept Of Defense: XML External Entity (XXE) Injection

The vulnerability is an XML external entity XXE injection flaw. XXE vulnerabilities occur when an application parses XML input that contains a reference to an external entity. When the XML parser is improperly configured to process external entities, it can lead to unauthorized access to sensitiv...

Exploit for Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Apache Streampipes

CVE-2024-29868: Use of Cryptographically Weak PRNG in Recovery...

WooCommerce 8.8.0 - 8.9.2 - Reflected XSS

Description The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an...

Exploit for Incorrect Conversion between Numeric Types in Microsoft

This repository contains a poc for CVE-2023-23388, which is desc...

Exploit for Untrusted Pointer Dereference in Microsoft

Exploit...

Exploit for Injection in Datagear

CVE-2024-37759 PoC Description DataGear version 5.0.0 and...

Exploit for CVE-2024-36527

CVE-2024-36527 PoC and Bulk Scanner !Bannerscreens/screen.j...

GHSA-HPCG-XJQ5-G666 Minder affected by denial of service from maliciously configured Git repository

Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the github.com/go-git/go-git/v5 library on these lines:...

GHSA-3J4H-H3FP-VWWW LNbits improperly handles potential network and payment failures when using Eclair backend

Summary Paying invoices in Eclair that do not get settled within the internal timeout about 30s lead to a payment being considered failed, even though it may still be in flight. Details Using blocking: true on the API call will lead to a timeout error if a payment does not get settled in the 30s...

Exploit for Unrestricted Upload of File with Dangerous Type in Elearningfreak Insert_Or_Embed_Articulate_Content

CVE-2024-0757 Exploit Description The Insert or Embed Art...

Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar

💥 WinRAR Vulnerability Description CVE-2023-38831 There...

curl: Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities

Vulnerability description not provided...

AEGON LIFE 1.0 Remote Code Execution

Exploit Title: Life Insurance Management System- Unauthenticated Remote Code Execution RCE Exploit Author: Aslam Anwar Mahimkar Date: 18-05-2024 Category: Web application Vendor Homepage: https://projectworlds.in/ Software Link: https://projectworlds.in/life-insurance-management-system-in-php/...

AEGON LIFE v1.0 Life Insurance Management System - Unauthenticated Remote Code Execution (RCE)

Exploit Title: Life Insurance Management System- Unauthenticated Remote Code Execution RCE Exploit Author: Aslam Anwar Mahimkar Date: 18-05-2024 Category: Web application Vendor Homepage: https://projectworlds.in/ Software Link: https://projectworlds.in/life-insurance-management-system-in-php/...

Exploit for Insufficiently Protected Credentials in Kyocera Net_Viewer

kygocera CVE-2022-1026 Improved Golang Version of Rapid7 PoC...

Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR

Description The plugin allows any authenticated user to join a private group due to a missing authorization check on a function PoC The PoC will be displayed on June 26, 2024, to give users the time to update...

Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF

Description The theme does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack The PoC will be displayed on June 26, 2024, to give users the time to update...