EUVD-2026-108132

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115330

Lotus versions up to and including 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can execute arbitrary SQL by submitting semicolon-separated stacked statements via POST /app/metrics/ . This method bypasses first-statement-only validation, potentially al...

EUVD-2026-108125

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to...

CVE-2026-115323

EverShop versions 1.2.2 before 2.2.1 are vulnerable to a missing authorization vulnerability in the customer address API. This flaw allows unauthenticated attackers to manage other customers' shipping addresses by sending POST , PATCH , or DELETE requests to the /api/customers/:customer_id/addres...

EUVD-2021-34897

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

CVE-2025-58434-PoC

CVE-2025-58434 PoC Python proof-of-concept script for triggering POST /api/v1/account/forgot-password. ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Credit zaddy6 Isaac David arthurgervais...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Post-Quantum KEM Timing Side-Channel Kyber Decapsulation Overview A vulnerable implementation of the Kyber KEM decapsulation leaks secret key bits through timing differences in the ciphertext rejection step, enabling full key recovery. Severity: Critical Private Key Compromise...

Spring4Shell-Python-Firewall-POC

Python Firewall for Spring4Shell CVE-2022-22965 Mitigation 1. Overview This project is a simple but effective firewall implemented as a Proof-of-Concept POC in Python. It's designed to act as an HTTP server that inspects incoming POST requests to detect and block the specific payload pattern...

CVE-2025-55182-POC

CVE-2025-55182 – Command Injection Vulnerability Scanner Full Proof-of-Concept With Real Command Output This repository contains a Python-based proof-of-concept PoC scanner for CVE-2025-55182, demonstrating how an attacker could exploit a command injection vulnerability through a JSON-based POST...

CVE-2026-75855

Title Path Traversal in "create database" / "drop database" server commands allows arbitrary file write and delete outside the configured database directory Summary The POST /api/v1/server endpoint's create database and drop database commands use the caller-supplied database name to build a...

cyberpanel-poc

CyberPanel v2.4 — Authenticated Privilege Escalation Chain...

CVE-2026-110011

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses...

CVE-2026-110010

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from ...

Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation

Incident Analysis: Check Point Security Gateway CVE-2024-24919 Exploitation Attempt 📌 Executive Summary On June 6, 2024, at 03:12 PM, security monitoring systems triggered an alert for a high-severity exploit attempt targeting a Check Point Security Gateway CP-Spark-Gateway-01, IP: 172.16.20.146...

CVE-2026-110011 MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses...

CVE-2026-110010 MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from ...

EUVD-2026-108013

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from ...

EUVD-2026-108014

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses...

CVE-2026-110011

The MB Custom Post Types & Custom Taxonomies WordPress plugin, in versions 2.4.0 through 2.12.2 , contains a vulnerability where it fails to perform a capability check within its export feature. This oversight allows users with a role as low as Contributor to access sensitive information, includi...