18528 matches found
MaNGOSWebV4 4.0.6 - Reflected XSS
Exploit Title: MaNGOSWebV4 4.0.6 - Reflected XSS Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/paintballrefjosh/MaNGOSWebV4 Software Link: https://github.com/paintballrefjosh/MaNGOSWebV4 Version: 4.0.6 Tested on: Ubuntu Windows CVE : CVE-2017-6478 PoC: // Access...
Django 5.1.13 - SQL Injection
Exploit Title: Django 5.1.13 - SQL Injection Google Dork: none Not applicable for this vulnerability Date: 2025-12-03 Exploit Author: Wafcontrol Security Team Vendor Homepage: https://www.djangoproject.com/ Software Link: https://www.djangoproject.com/download/ Version: 5.2 before 5.2.8, 5.1 befo...
📄 OpenRepeater 2.1 Command Injection
OpenRepeater version 2.1 suffers from a command injection vulnerability. Exploit Title: OpenRepeater 2.1 - OS Command Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/OpenRepeater/openrepeater Software Link: https://github.com/OpenRepeater/openrepeater...
📄 phpMyAdmin 5.0.0 SQL Injection
phpMyAdmin version 5.0.0 suffers from a remote SQL injection vulnerability. Exploit Title: phpMyAdmin 5.0.0 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/phpmyadmin/phpmyadmin/ Software Link: https://github.com/phpmyadmin/phpmyadmin/ Version: 5.0....
📄 Microsoft Windows 11 Build 10.0.22631.6199 Advanced Admin Protection Bypass
This enhanced proof of concept exploit demonstrates an advanced method for bypassing Windows Administrator Protection by manipulating registry hives using both WinAPI and NTAPI. The code implements safe smart‑pointer wrappers for handles, secure SID management, deep registry enumeration, privileg...
📄 MobileDetect 2.8.31 Cross Site Scripting
MobileDetect version 2.8.31 suffers from a cross site scripting vulnerability. Exploit Title: MobileDetect 2.8.31 - Cross-Site Scripting XSS Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/serbanghita/Mobile-Detect/ Software Link:...
📄 Microsoft Windows 11 Build 10.0.22631.6199 Registry Vulnerability Testing Tool
This is a C/C++ proof-of-concept PoC program designed to test for a specific vulnerability within the Windows Registry handling mechanism, often related to key duplication or improper permission checks during certain API calls like RegCopyTreeW...
📄 YOURLS 1.8.2 Cross Site Request Forgery
YOURLS version 1.8.2 suffers from a cross site request forgery vulnerability. Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery CSRF Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/yourls/yourls/ Software Link: https://github.com/yourls/yourls/ Version: 1.8....
phpIPAM 1.4 - SQL-Injection
Exploit Title: phpIPAM 1.4 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/phpipam/phpipam/ Software Link: https://github.com/phpipam/phpipam/ Version: 1.4 Tested on: Windows CVE : CVE-2019-16693 Proof Of Concept Ensure you have a valid user session...
Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil
cve-2021-21551-PoC This repo contain a PoC I have done whe...
CVE-2025-65806
creationtimestamp| type| source ---|---|--- 2025-12-02 11:45:45+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/61366 2025-12-02 15:00:08+00:00| published-proof-of-concept| Telegram/dX7Pwj7PqnF2da8IVWPgq-aFC6NZmOtStQ4m7OfqjtGR0Q...
Exploit for Improper Authorization in Vercel Next.Js
📦 Next.js CVE-2025-29927 - Proof of Concept This repository c...
CVE-2025-65321
creationtimestamp| type| source ---|---|--- 2025-12-02 09:00:05+00:00| published-proof-of-concept| Telegram/-j9GoQjMLfU83nNXg48f-GpPBYCZFQAe4vs-fv-sdiLYcz8...
CVE-2025-66454
creationtimestamp| type| source ---|---|--- 2025-12-02 00:58:19+00:00| published-proof-of-concept| https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438...
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
Summary An IDOR Insecure Direct Object Reference vulnerability in the Grav CMS Admin Panel allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk...
GHSA-RMW5-F87R-W988 Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the datareadableName parameter. The injected scripts are stored on the server and...
GHSA-MPJJ-4688-3FXG Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the dataheadermetadata, dataheadertaxonomycategory, and dataheadertaxonomytag parameters. These...
CVE-2025-66298
creationtimestamp| type| source ---|---|--- 2025-12-01 20:41:41+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-8535-hvm8-2hmv...