CVE-2026-44262

dedoc/scramble RCE CVE-2026-44262 PoC 📜 Description CVE-2026-44262 is an unauthenticated Remote Code Execution vulnerability in dedoc/scramble, a Laravel API documentation generator. NodeRulesEvaluator::doEvaluateExpression calls extract$variables before eval"return $code;". When a controller...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

CVE-2026-0770

CVE-2026-0770: Langflow execglobals Unauthenticated Remote Code Execution PoC CVE-2026-0770 an unauthenticated Remote Code Execution RCE vulnerability affecting Langflow. The flaw stems from improper input validation within the handling of the execglobals parameter provided to the /validate...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Doctreat Core versions = 1.6.8 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated attackers t...

CVE-2024-41640

Description AML Surety Eco up to version 3.5 is affected by an un-authenticated reflected cross-site scripting. The target web application handles error in a dedicated error page accessible without any authentication containing a URL parameter that is not sanitizing user input. The provided...

CVE-2026-52813-Gogs-RCE

CVE-2026-52813 — Gogs Path Traversal Leading to Git Hooks Remote Code Execution Defensive Analysis Security research / Blue team writeup. This repository does not contain weaponized PoC. Researchers needing reproduction should use the public PoC referenced in the official advisory. Item| Content...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ En pruebas Este PoC se está probando y refinando activamente. Las características pueden cambiar entre versiones. CVE-2026-3180 WordPress Contest Gallery — Inyección SQL Ciega Sin Autenticar Herramienta de evaluación de prueba de concepto para CVE-2026-3180 Autor: Sudeepa Wanigarathna ·...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQL Injection Lab Unauthenticated SQL Injection in Tutor LMS WordPress plugin = 3.9.6 via the couponcode parameter. Quick Start root@kitploit: 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPres...

directus-security

directus-security Audit any Directus instance for the misconfigurations that actually leak data — public-role read exposure, user enumeration, unauthenticated version/schema leaks, GraphQL introspection, and the search-param field-enumeration oracle — and prove each one live with an anonymous...

CVE-2025-39247

CVE-2025-39247 Target: HikCentral Professional HCMP, central VMS server CVE: CVE-2025-39247 — Access Control Vulnerability CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affected: V2.3.1 – V2.6.2 and V3.0.0 Fixed: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 Disclosed: 2025-08-28 Analysis date:...

CVE-2023-2598

CVE-2023-2598 Privilege Escalation Understand the Compound Page and folio mechanisms in Linux through CVE-2023-2598, and subsequently see if it's possible to complete the exploitation of the 1day CVE-2023-6560. Compound Page huge page Memory is growing larger and larger, but the basic page...

CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

awspwn

AWSPwn - AWS attack-path automation Enumerate an account's IA...

CVE-2026-9082

Drupal CVE-2026-9082 Scanner Semi-passive scanner that detects Drupal installations potentially vulnerable to CVE-2026-9082 PostgreSQL SQL injection. No SQL payloads sent. No state-changing requests. Vulnerable Versions Branch| Affected| Fixed ---|---|--- 10.4.x| 8.9.0 — 10.4.9| 10.4.10 10.5.x|...

CVE-2024-48589

phpAbook 9.0i - Cross-Site Scripting XSS Vulnerability CVE-2024-48589 Summary: A Cross-Site Scripting XSS vulnerability was discovered in the rol parameter of index.php or the path section in the phpAbook application. This vulnerability allows an attacker to inject arbitrary JavaScript code into ...

CVE-2018-16763

CVE-2018-16763 Analyzer CVE-2018-16763 Analyzer is a small Python project for analyzing CVE-2018-16763 against FUEL CMS targets. It focuses on checking whether a target appears vulnerable and on displaying command output in a cleaner, more readable way when the application response is noisy. This...

mysqli

MySQLi.py - Time-Based Blind SQL Injection for MySQL MySQLi.py is a personal practice project, inspired by Exploit-DB exploit 46635, used during the SimpleCTF room on TryHackMe. What caught my attention in the original exploit was its ability to extract credentials and even crack the password has...

CVE-2026-24418

CVE-2026-24418 OpenSTAManager = 2.9.8 — Error-Based SQL Injection in Scadenzario Bulk Operations Module Overview Field| Details ---|--- CVE ID| CVE-2026-24418 Severity| HIGH 8.8 CWE| CWE-89: SQL Injection Affected Versions| OpenSTAManager = 2.9.8 Vulnerable Parameter| idrecords POST array...

CVE-2021-39408

CVE-2021-39408 A reflected Cross Site Scripting XSS vulnerability exists in multiple version 1.0 of the Online Student Rate System application that allows for arbitrary execution of JavaScript commands. Vulnerable Page On index.php, the page parameter is vulnerable, allowing an attacker to includ...