290662 matches found
Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference
Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...
Paperclip - Remote Code Execution
Paperclip 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target. id: CVE-2026-41679 info: nam...
Citrix SD-WAN Center - Local File Inclusion
Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this...
Dify v1.9.1 - Broken Access Control
Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. id: CVE-2025-63387 info: name: Dify v1.9.1 - Broken Access Control author:...
Web-Check < 2.0.1 Screenshot API - OS Command Injection
Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...
Spring Cloud Config Server - Path Traversal
Spring Cloud 3.1.x 3.1.13, 4.1.x 4.1.9, 4.2.x 4.2.3, 4.3.x 4.3.2, and 5.0.x 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. i...
Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting
Sourcecodester Online Event Booking and Reservation System 2.3.0 contains a cross-site scripting vulnerability in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clic...
CVE-2025-21293
CVE-2025-21293 CVE-2025-21293 is an elevation of privilege vulnerability in Active Directory Domain Services. It allows "Network Configuration Operators" to execute code with SYSTEM privileges via Windows Performance Counters. Affected Windows versions include Windows 10, 11, and Server. Microsof...
CVE-2019-12889
CVE-2019-12889 Summary An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate their privileges to NT AUTHORITY\System. An attacker would need local access to the machine for a successful exploi...
CVE-2022-30513
CVE-2022-30513 School Dormitory Management System 1.0 - Reflected XSS Exploit Title: School Dormitory Management System 1.0 - Reflected XSS Date: 2022-05-25 CVE: CVE-2022-30513 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
CVE-2022-38813
CVE-2022-38813 Veritical Privilege Escalation via user parameter in Blood Donor Management System Using Codeigniter v 1.0 Technical description: Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete t...
CVE-2023-50070
CVE-2023-50070 Customer Support System 1.0 - Multiple SQL injection vulnerabilities - saveticket Description : Multiple SQL injection vulnerabilities in /customersupport/ajax.php?action=saveticket in Customer Support System 1.0 allow authenticated attackers to execute arbitrary SQL commands via...
CVE-2016-0051
CVE-2016-0051 Proof-of-concept BSoD Blue Screen of Death and Elevation of Privilege to SYSTEM code for my CVE-2016-0051 MS-016. EoP to SYSTEM on Windows 7 SP1 x86 BSoD on a Windows 10 x64 Links Microsoft Security Bulletin MS16-016 Microsoft Acknowledgements page A variant of this PoC where the...
CVE-2024-34313
CVE-2024-34313 Description VPL Jail System up to v4.0.2 was discovered to contain a Path Traversal vulnerability allowing arbitrary file overrides and thereby privilege escalation to root user. This vulnerability can be chained with CVE-2024-34312 to take over a Moodle instance remotely without a...
CVE-2023-50071
CVE-2023-50071 Customer Support System 1.0 - Multiple SQL injection vulnerabilities - savedepartment Description : Multiple SQL injection vulnerabilities in /customersupport/ajax.php?action=savedepartment in Customer Support System 1.0 allow authenticated attackers to execute arbitrary SQL comman...
CVE-2017-0213
CVE-2017-0213 I used the code provided by the Google Project Zero Team here: https://github.com/WindowsExploits/Exploits/tree/master/CVE-2017-0213 The changes I made allow the program to call a powershell oneliner that will give me an Empire agent on the target. I will use this for privilege...
FstHook
FstHook A library for intercepting native functions by hooking KiFastSystemCall Note: KiFastSystemCall hooking only works on the following systems: Windows XP Service Pack 3 32-bit Windows Vista 32-bit Windows 7 32-bit...
CVE-2024-27686
MikroTik RouterOS Denial of Service Vulnerability 📌 Description This document describes a Denial of Service DoS vulnerability found in certain versions of MikroTik RouterOS. The vulnerability is due to insufficient handling of crafted SMB requests. A remote attacker could exploit this issue by...
EUVD-2026-100714
CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended...