CVE-2024-35511

PHPGurukul Men Salon Management System 2.0 Welcome to the PHPGurukul Men Salon Management System 2.0 repository. This project aims to provide a robust system for Men Salon Management. Security Vulnerabilities CVE-2024-35511 Description: Vulnerable to SQL Injection via 'username' parameter. Affect...

CVE-2022-32988

CVE-2022-32988 Affected products We have not yet tested Asus models other than those listed. However we suspect it may also work on other models with the same firmware version. root@kitploit: DSL-N14UB1 V.1.1.2.3805 Overview In router Asus DSL-N14U-B1 1.1.2.3805 was discovered to contain a stored...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder Unauthenticated RCE Mass exploit toolkit for CVE-2026-5524 , an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder = 5.1.8 leading to remote code execution. Field| Value ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector|...

proofpoint-CVE-2023-0089

About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Low level authenticated user to admin RCE CVE: CVE-2023-0089 Timeline: Discovered - ly1g3 Reported - ly1g3...

CVE-2026-39492

CVE-2026-39492 — WP Maps Blind SQL Injection Scanner Pre-Auth Time-Based Blind SQLi via Backtick Bypass → DB Extraction Overview CVE-2026-39492 is a critical-severity CVSS 9.3 unauthenticated blind SQL injection vulnerability in the WP Maps plugin wp-google-map-plugin versions ≤ 4.9.1. The...

CVE-2024-57427

CVE-2024-57427 - Reflected Cross-Site Scripting XSS PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting XSS. Multiple endpoints improperly handle user input, allowing malicious scripts to execute in a victim’s browser. Attackers can craft malicious links to steal...

CVE-2021-44228_scanner-main-Modified-

CVE-2021-44228scanner modified - Deprecated Original Script and Repo: https://github.com/CERTCC/CVE-2021-44228scanner Modified by: Alex Pena Applications that are vulnerable to the log4j CVE-2021-44228 issue may be detectable by scanning jar, war, and ear files to search for the presence of...

CVE-2026-82727

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

wp2shell

wp2shell WordPress REST batch route-confusion blind SQL injection — automated exploit chain. CVE-2026-63030 / CVE-2026-60137 | ---|--- Affected| WordPress 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1 Fixed| WordPress 6.9.5 / 7.0.2 Sink| authornotin SQL via desync'd authorexclude parameter Auth required| None...

CVE-2026-63030-POC

wp2shell — CVE-2026-63030 + CVE-2026-60137 One-day WordPress RCE exploit chain. Unauthenticated. CVSS 9.8. Zero dependencies — Python 3.8+ stdlib only. Affected Versions Branch| Vulnerable| Patched ---|---|--- 6.9.x| 6.9.0 – 6.9.4| ≥ 6.9.5 7.0.x| 7.0.0 – 7.0.1| ≥ 7.0.2 The Chain Two CVEs chained...

CVE-2026-42568

CVE-2026-42568 — YAMCS LDAP Injection in LdapAuthModule Summary An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule. The username parameter is inserted directly into LDAP search filters without RFC 4515 escaping, allowing authentication bypass...

CVE-2026-36670

CVE-2026-36670 A time-based blind SQL injection exploit for the OpenSIPS Control Panel. This exploit abuses an authenticated sql injection vulnerability within the aliasmanagement.php module of opensips. The table GET parameter is improperly sanitized, allowing an attacker to inject a crafted...

CVE-2026-26719

Description Summary A stored Cross‑Site Scripting vulnerability exists in xxl-job-admin JobInfoController.java where the addressList parameter accepts unsanitized URL‑encoded JavaScript. The payload is stored and later executed in users’ browsers, lead unauthorized actions. Affected Products...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

CVE-2019-20933

LAB 5-CVE-2019-20933 I. SYSTEM ANALYSIS Identifying the Attack Surface Starting with what is running in the environment. I list all active containers: root@kitploit: docker ps The victim exposes a single port:8086. Currently, I do not have detailed information about the target. From the docker ps...

struts-uploader-vulnerability

CVE-2024-53677 — How the Exploit Works and How to Run It Vulnerability summary The flaw is in how Struts' FileUploadInterceptor hands off the uploaded filename to the action class. Normally the interceptor sanitizes the filename, but Struts also lets any multipart parameter be processed as an OGN...

CVE-2025-70828

CVE-2025-70828 Summary An arbitrary file read vulnerability was discovered in Datart v1.0.0-rc.3. The application fails to properly validate the JDBC connection URL during data source configuration. Vulnerability Details Vulnerability Type: Improper Input Validation CWE-20 / Arbitrary File Read...

CVE-2023-49988

CVE-2023-49988 Hotel Booking Management v1.0 - SQL Injection Vulnerability in the "npss" parameter at rooms.php Description : A SQL Injection vulnerability exists in version 1 of the Hotel Booking Management. A malicious attacker can issue SQL commands to the MySQL database when editing the price...

PressVector

🧨 PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Exploitation Framework ⚡ Advanced Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core 📌 Overview PressVector is a comprehensive, fully automated exploitation framework targeting CVE-2026-63030 and CVE-2026-60137 — two...

CVE-2025-29338

CVE-2025-29338 — Security Advisory Buffer Overflow in NXP moal.ko Wi-Fi Kernel Driver woalsetupmoduleparam / parsecfggetline Field| Value ---|--- CVE ID| CVE-2025-29338 Severity| High CVSS v3.1 Score| 7.8 CVSS v3.1 Vector| CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Vulnerability Type| Stack-Bas...