CVE-2026-4889

The eLoanApp platform by RDL Technologies contains a SQL injection (SQLi) vulnerability in the '/ajax/users.php?op=verify' endpoint. The vulnerability exists in the 'logina' POST parameter, which is susceptible to both boolean-based and time-based SQL injection. Successful exploitation enables an...

CVE-2026-75962

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Произвольное удаление записей Обзор Критическая ошибка авторизации была обнаружена в плагине WordPress Frontend File Manager nmedia-user-file-uploader , затрагивающая версии = 23.6. Уязвимость позволяет аутентифицированным пользователям с...

CVE-2025-32583

🚨 CVE-2025-32583 — Эксплойт RCE для WordPress PDF 2 Post КРИТИЧЕСКАЯ уязвимость CVE-ID: CVE-2025-32583 Критичность: 9.9 КРИТИЧЕСКАЯ CVSS-вектор: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Описание Уязвимость в плагине PDF 2 Post для WordPress разработанном termel позволяет выполнить удалённое...

CVE-2026-75962

The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...

EUVD-2026-92961

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2019-20224

CVE-2019-20224 Официальный эксплойт для Pandora v7.0NG Post-auth Remote Code Execution CVE-2019-20224...

React2Shell

Docker Lab & Detection Scanner & PoC Validation: React2Shell CVE-2025-55182 Дисклеймер: Этот репозиторий и его PoC-артефакты созданы строго в образовательных, исследовательских целях и для демонстрации защитных механизмов в изолированной лабораторной среде. Несанкционированное тестирование внешни...

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

CVE-2025-55182-POC

CVE-2025-55182 – Сканер уязвимости инъекции команд Полное доказательство концепции с реальным выводом команды Этот репозиторий содержит сканер, основанный на Python, в качестве доказательства концепции PoC для CVE-2025-55182, демонстрирующий, как злоумышленник может эксплуатировать уязвимость...

reverie

Reverie Эффективная реализация NIZKPoK, описанного в KKW 2018 Reverie — это реализация доказательство и проверка NIZKPoK в парадигме MPC-in-the-head, описанного в работе Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures. Reverie стремится обеспечить конкретную...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

EUVD-2026-92842

vLLM: Harmony tool continuations drop cachesalt — restoring a cross-tenant prefix-cache membership oracle...

PT-2026-106717

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

CVE-2024-32002

GIT RCE CVE-2024-32002 Description | CVE-2024-32002 | https://www.tarlogic.com/blog/cve-2024-32002-vulnerability-git/ | Exploit | First you need to create "calledrepo" "commandrepo" repos on git. | Victim will later call the calledrepo with "git clone --recursive calledrepo.git" that redirect to...

CVE-2026-105752

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...