PT-2026-104490

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a malicious filename is supplied to the ppress...

PT-2026-104537

Name of the Vulnerable Software and Affected Versions WPMobile.App – Android and iOS App Builder versions prior to 11.85 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages...

cve-2025-24035-rds-websocket-dos-test

CVE-2025-24035 Prueba de Estrés WebSocket Seguro 🚨 DESCARGO DE RESPONSABILIDAD : Esto NO es un exploit. Este script es una simulación y solo debe utilizarse con fines educativos en un entorno de laboratorio seguro. Propósito Esta prueba envía deliberadamente un encabezado WebSocket de tamaño...

F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit

F5 BIG-IP CVE-2023-46747 – RCE sin autenticación + Shell inversa Versiones para Python3 y Nuclei – por raguraman RCE crítica sin autenticación CVSS 9.8 mediante AJP + contrabando de solicitudes HTTP Funciona en todos los BIG-IP sin parche 13.x → 17.x incluyendo el último 17.1.0.3 Parche:...

CVE-2023-22622

DoS WP-Cron - CVE-2023-22622 Exploit PoC Overview This repository contains a script that exploits the CVE-2023-22622 vulnerability in WordPress, causing a Denial of Service DoS via WP-Cron. This script can be used to flood a vulnerable WordPress site with requests, potentially leading to server...

auto-repeater

AutoRepeater: Repetición Automatizada de Solicitudes HTTP Con Burp Suite tl;dr Dentro de extender importe AutoRepeater.jar Algunas Instrucciones Breves AutoRepeater solo reenviará las solicitudes que sean modificadas por un reemplazo definido. Cuando AutoRepeater recibe una solicitud que coincide...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...

CVE-2026-37070

CVE-2026-37070 Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

Roxy

Roxy Proxy de interceptación HTTP/HTTPS minimalista basado en terminal. https://github.com/user-attachments/assets/94f9c9ae-5842-4b19-9f5b-84dedb9430e6 Características · Instalación · Soporte HTTPS · Uso · Cómo funciona Descripción general Roxy es un proxy de interceptación ligero para HTTP y HTT...

EUVD-2026-91802

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerable a falsificación de solicitud del lado del servidor Carga útil : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHER...

CVE-2025-50365_CSRF_DELETE_CATEGORY-phpgurukul-CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Client Side Request Forgery Affected Versions: v1.0 💣Vulnerability Description: A Cross-Site Request Forgery CSRF vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing...

CVE-2026-39718 WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6...

CVE-2026-39718

The Webriti Wallstreet WordPress theme is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions from the initial release through 2.8.6 . The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. No specific expl...

EUVD-2026-91774

Cross-Site Request Forgery CSRF vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6...

CVE-2020-37278 Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile

Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...

EUVD-2020-31274

Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...

Security Bulletin: Vulnerability in aiohttp bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the aiohttp library, which is affected by multiple vulnerabilities, including HTTP request smuggling and out-of-bounds read vulnerabilities. CVE-2026-69243, CVE-2026-69244. Vulnerability Details CVEID:CVE-2026-69243...

CVE-2026-94485

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Aviso de Seguridad: Inyección en Cabeceras HTTP mediante CR y LF sin Validar en Valores de Cabecera tinyhttp ID de CVE asignado: CVE-2026-66753 Resumen tinyhttp no rechaza el retorno de carro ni el avance de línea dentro de los valores de las cabeceras HTTP, en ninguna de las dos direcciones. En ...