CVE-2026-108680

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver...

CVE-2026-108680

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) affecting the POST /sys/api/sendTemplateAnnouncement endpoint. This flaw allows any authenticated user to send template notifications. A low-privileged attacker can exploit this by supplying forged ...

CVE-2026-108680 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver...

CVE-2026-108680

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver...

CVE-2026-108664

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the AiragPromptsController queryById handler. This vulnerability allows low-privileged authenticated users to access any AI prompt template by exploiting the unguarded /airag/prompts/list endpoint to enumerate IDs....

CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to...

XWiki-Platform-RCE-CVE-2025-24893

XWiki Platform Unauthenticated RCE Exploit Overview This script is a refurbished Bash implementation of an exploit targeting the XWiki Platform versions affected by CVE-2025-24893. It leverages a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitra...

phishing-frenzy

Phishing Frenzy Ruby on Rails Phishing Framework Documentation & Info Relevant up to date documentation can be found on the official Phishing Frenzy website located below Phishing Frenzy Website Please submit any tickets or issues to the github issues page Phishing Frenzy Tickets To contact us...

POC_CVE-2026-45185

CVE-2026-45185 Nuclei Template Validation Lab This repository is not a general-purpose exploit PoC repository. It is a local validation lab for reproducing and reviewing the behavior of a CVE-2026-45185 template intended for contribution to projectdiscovery/nuclei-templates. The nuclei code...

CVE-2022-29078

CVE-2022-29078 | EJS SSTI → RCE White Hat School 4th Class 32 - Sangbeom Woo @taka3636 Summary EJS tags, such as Hello . Internally, EJS compiles the template string into a JavaScript function and then executes it to generate the final HTML. In other words, it is a code generator that "converts...

magento2-template-filter-patch

Parche del Filtro de Plantillas de Magento 2 para CVE-2022-24086, CVE-2022-24087 Parche de Magento 2 para CVE-2022-24086, CVE-2022-24087. Corrige la vulnerabilidad RCE y los errores relacionados mediante un escape profundo de variables de plantilla. Si no puede actualizar Magento o no puede aplic...

cve-2021-4034

cve-2021-4034...

Vvveb-CMS-CVE-2025-8518

Vvveb-CMS-CVE-2025-8518 This repository contains a Proof of Concept PoC demonstrating a critical vulnerability in givanz Vvveb 1.0.5. The vulnerability allows an authenticated user with template editing privileges to write arbitrary PHP code to server files, leading to Remote Code Execution RCE...

cve-2024-32651

cve-2024-32651 changedetection rce mediante ssti...

CVE-2024-4040

CVE-2024-4040 PoC Python exploit for CVE-2024-4040 Description A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass...

vert-x3__vertx-web_CVE-2018-12542_3-5-3-CR1

= Vert.x-Web image:https://vertx.ci.cloudbees.com/buildStatus/icon?job=vert.x3-web"Build Status",link="https://vertx.ci.cloudbees.com/view/vert.x-3/job/vert.x3-web/" image:https://img.shields.io/maven-central/v/io.vertx/vertx-web.svg"Maven Central"...

CVE-2025-24367

CVE-2025-24367 CVE-2025-24367 - Cacti Authenticated Graph Template RCE...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...

cve-2026-9558-poc

CVE-2026-9558 — Mautic Theme Templates Server-Side Template Injection SSTI to Full Admin Takeover Table of Contents Overview Affected Versions Root Cause Analysis Repository Structure Requirements Usage Expected Output References Disclaimer Overview CVE-2026-9558 is a Server-Side Template Injecti...