CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 Proof-of-Concept This repository contains a Proof-of-Concept PoC for CVE-2025-55182 , a vulnerability involving Prototype Pollution leading to Remote Code Execution RCE in certain server‑side rendering implementations. ⚠️ Warning: This PoC is strictly for educational, research, and...

CVE-2025-57298

Stored XSS via Unsafe Markdown Rendering in Kotaemon Summary Kotaemon is an open-source RAG Retrieval-Augmented Generation based document QA system that provides a web interface for querying uploaded documents such as PDF, Word, and Excel files. A stored cross-site scripting XSS vulnerability...

CVE-2026-28496-Lab

CVE-2026-28496 - FOSSBilling Server-Side Template Injection in Twig Rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-28496, a Server-Side Template Injection vulnerability affecting FOSSBilling's Twig template rendering behavior...

CVE-2026-999999

X-Trading Portal: Regional Financial Infrastructure v1.4.2 Overview This repository contains the core distribution and deployment configurations for the X-Trading Portal XTP , a containerized solution designed for retail banking and stock trading services. This version v1.4.2 includes the updated...

mitigate-cve-2026-23869-react-server-component-loops

How to Fix CVE-2026-23869: Mitigate React Server Component Loops Securing modern enterprise frontend applications requires continuous monitoring of server-side data fetching layouts and framework component life cycles. With the recent public disclosure of CVE-2026-23869, engineering teams are...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

research-labs

Researcher's labs This repository contains a number of intentionally vulnerable applications that you can use to explore vulnerabilities found by PortSwigger Research. Note that you can find many free online labs designed by PortSwigger Research in the Web Security Academy. Table of contents...

CVE-2018-7600

CVE-2018-7600 Drupalgeddon2 Exploit – Python3 DISCLAIMER: This project is for educational and authorized penetration testing purposes only. Do NOT use this code on systems you do not own or have explicit written permission to test. Unauthorized use is illegal and punishable by law. The author...

CVE-2024-38856-Apache-OFBiz

CVE-2024-38856 — Apache OFBiz Repository documentation Repository purpose: informational documentation about CVE-2024-38856 Apache OFBiz incorrect-authorization / pre-auth RCE. This repository does not contain weaponized exploit code. It is intended for defensive research, patching guidance,...

CVE-2025-24893-XWiki-SSTI-RCE

CVE-2025-24893 — XWiki SSTI Remote Code Execution Overview Field| Details ---|--- CVE| CVE-2025-24893 Software| XWiki Vulnerability| Server-Side Template Injection SSTI → RCE Authentication| Not required CVSS Score| Critical Context| Discovered during HackTheBox CTF Description XWiki exposes a...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors White Hat School 4th Cohort, Class 25 임두연@endusdksla Summary XWiki interprets wiki syntax and macros on the server side and renders them. The issue is that the Main.SolrSearch page is open to guests, yet it evaluates the user input...

CVE-2025-68116

CVE-2025-68116 Author: @x0root Vulnerability: Stored Cross-Site Scripting XSS via Browser-Renderable Uploads SVG / HTML Affected Software: FileRise Note: GHSA-qrcv-vjvf-fr29 introduced a mitigation that prevented SVGs from rendering inside the FileRise web UI preview pane. This report documents a...

CVE-2025-55780

CVE-2025-55780 Null Pointer De-reference in MuPDF 1.26.4 EPUB Rendering Function CVE Reference - CVE-2025-55780 Affected Versions : 1.26.7 and before are affected Found and tested on : 1.26.4 Severity CVSSv3 score : 7.5 High Fixed in commit :...

CVE-2026-113280

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the browser sandbox by convincing a user to visit a specially crafted HTML page. The issue stems from a memory corruption condition within the Paint rendering component...

CVE-2026-96644 Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

CVE-2026-96644

The Pillow Python imaging library is vulnerable to a heap over-read on Windows systems prior to version 13.0.0 . The issue occurs because src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. This handler incorrectly sizes a DIB al...

CVE-2026-96644 Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

GHSA-J4M9-6W36-PW47 Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FTLoadGlyph fails for a glyph, the cleanup path calls FTDoneGlyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render...

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FTLoadGlyph fails for a glyph, the cleanup path calls FTDoneGlyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render...

CVE-2026-114128

A flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted input that prematurely closes the tag and injects malicious...