CVE-2023-33408

CVE-2023-33408 Minical 1.0.0 is vulnerable to Stored Cross-Site Scripting XSS Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: Log in to the Minical Application and Navigate to Room-Room Status. Step 2: Click on the Edit Room Note option and enter...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit by kaal Exploits 1. HotelDruidExploit.py This Exploit will create new room with our PHP payload as a room name . Usage : $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...

BreakEscape

BreakEscape Rails Engine Cybersecurity training escape room game as a mountable Rails Engine. Features 24+ cybersecurity escape room scenarios Server-side progress tracking with 2-table schema Randomized passwords per game instance via ERB JIT Ink script compilation for NPC dialogue Polymorphic...

CVE-2022-22909

CVE-2022-22909 Description A Code Injection vulnerability has been found on the Hotel Druid v3.0.3 application, which an attacker could exploit to execute remote code on the server. For a successful exploitation, an attacker should have the privilege to add a new room. Vulnerability description T...

readme2demo

readme2demo — verified tutorials & demo videos from your README ▶ readme2demo generating its own tutorial: an AI agent runs this repo's README in a sandbox, a fresh container replays every step, then the demo is rendered. Full self-run output in examples/readme2demo · run against another project ...

Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion

Barco Control Room Management through Suite 2.9 Build 0275 is vulnerable to local file inclusion that could allow attackers to access sensitive information and components. Requests must begin with the "GET /...." substring. id: CVE-2022-26233 info: name: Barco Control Room Management Suite =2.9...

CVE-2021-44228_PoC

POC for CVE-2021-44228 This python script was created while I was working on the TryHackMe room for Log4j. While this was created with default variables for this room, I used argparse to make the script versatile for a GET request. All necessary varaibles can be changed with different options, se...

CVE-Research

TryHackMe Room - tryhackme.com/jr/cvechallenge Video -...

CPSC253_CybersecurityFinalProjectReports

Introduction These papers were part of my final project for my Cybsecurity class: CPSC 253 - Cybersecurity Foundations and Principles The premise of my final project was that I was a newly hired consultant in a research center and helped optimize their security around their server room. Phase 1 W...

CVE-2026-107702 QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess that allows restricted back-office employees to access other hotels' data by supplying an idhotel parameter. Attackers can modify the idhotel URL parameter on the Book Now page to...

TryHackMe-Solar-exploiting-log4j-

This repository does not have a README...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Security Advisory: Insufficient Access Controls Allow for Unauthorized Room Deletion Let's Chat Assigned CVE ID: CVE-2026-66751 Summary DELETE /rooms/:room performs no authorization check beyond requiring a login. Any account can archive any room on the server, including private, password protect...

CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...

CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...

EUVD-2026-90437

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

EUVD-2026-90438

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103589

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103590

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103590 QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...