CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2024-0710

CVE-2024-0710 Vulnerability: CVE-2024-0710 Unauthenticated Form Submission Unique ID Modification CVSS: 5.3 Medium Software: GP Unique ID gp-unique-id Affected versions: = 1.5.5 Patched version: 1.5.6 Developer: Gravity Wiz Researcher: Karl Emil Nikka, Nikka Systems Publicly published: 2024-04-10...

ShadowRay-RCE-PoC-CVE-2023-48022

PoC for a remote command execution vulnerability in Ray framework CVE-2023-48022 This exploit script and PoC are written for an in-depth CVE analysis on vsociety. The Ray framework, an essential tool for Python-based AI and machine learning applications, has encountered a significant security...

crawlergo

crawlergo A powerful browser crawler for web vulnerability scanners English Document | 中文文档 crawlergo is a browser crawler that uses chrome headless mode for URL collection. It hooks key positions of the whole web page with DOM rendering stage, automatically fills and submits forms, with...

strelka-ui

Releasesrelease | Pull Requestspr | Issuesissues !GitHub releaseimg-version-badgerepo !Build Statusimg-actions-badgeactions-ci !Pull Requestsimg-pr-badgepr !Slackimg-slack-badgeslack !Licenseimg-license-badgelicense Strelka Web UI — это браузерный и API-ориентированный фронтенд для отправки файло...

CVE-2026-88783

The Kubio AI Page Builder WordPress plugin, in versions prior to 2.9.3 , is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to restrict the expansion of allowed HTML elements solely to the editor context; instead, the wider set of allowed ...

CVE-2026-101159 WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators,...

Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requestedpage' POST parameter in the verifyusernamepassword function. This makes it possible for unauthenticated...

raccoon_config

raccoonconfig Сканирует список raccoon-серверов из Tria.ge и извлекает конфигурацию в формате JSON. При желании может также автоматически отправлять дополнительное вредоносное ПО, извлечённое из конфигурации Raccoon, в Tria.ge требуется API-ключ Ресурсы: Логотип:...

Ray < 2.52.0 - Remote Code Execution

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...

CVE-2026-33017

CVE-2025-62593 — Эксплойт неаутентифицированного RCE в Ray Обзор CVE-2025-62593 — это уязвимость неаутентифицированного удалённого выполнения кода в распределённом AI-движке вычислений Ray. Корневая причина — отсутствие аутентификации на критических HTTP-эндпоинтах /api/jobs, /api/jobagent/jobs...

CTT-Kernel-Resonance-io_uring-Temporal-Phase-Transition

Этот эксплойт для CVE-2026-24102 представляет собой вершину серии SimoesCTT. Атакуя iouring — самый продвинутый асинхронный интерфейс ядра Linux — вы атакуете саму концепцию «последовательной логики». В iouring системные вызовы не выполняются; они текут. Мы воспользуемся Временным окном между...

CVE-2026-7222-XSS

Хранимая межсайтовая XSS-уязвимость в системе управления репетиторством приводит к захвату учётной записи Продукт Система управления репетиторством на PHP Code-Projects.org https://code-projects.org/coaching-management-system-in-php-with-source-code/ Затронутые компоненты...

CVE-2023-48022

CVE-2023-48022 Эксплойт CVE-2023-48022, модифицированный на основе работы Bishop Fox Как использовать укажите ip и port в jobs.py укажите payload в malicious.py $ pip install ray $ python3 jobs.py...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2026-19500-poc

CVE-2026-19500 Poc and writeup Description Sureforms is vulnerable to a DOS vulnerability , when attacker can submit unlimited key-value pair, leads to resource exhaustion and the administrator can not watch entries temporary. How to reproduce Submit the Form which is made by Sureforms plugin, an...

CVE-2026-103285

Ghost versions from 5.19.0 before 6.57.1 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the post feedback functionality . This flaw allows an attacker to craft a malicious link that, when visited by an authenticated member, automatically submits feedback on their behal...

Hybrid Submit

Hybrid Analysis Batch Submission Script This Python script recursively scans a folder and submits executable, script, document, and other relevant files to Hybrid Analysis Falcon Sandbox for automated malware analysis. Features Recursively walks through directories Submits only supported file typ...

WordPress Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms plugin <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Frontend Post Submission Manager Lite versions = 1.3.4...