CVE-2022-4896

CVE-2022-4896 PoC & exploits for CVE-2022-4896 "Control de Ciber" is a Cybercafe management software. Multiple Denial-of-Service DoS vulnerabilities in versions prior to 1.650. An unauthenticated remote attacker can send a carefully crafted request that lead to a service crash. Spooler DoS Spoole...

CVE-2026-80465

CVE-2026-80465 affects the Mendix SAML module across multiple compatibility lines: Mendix 10 (all versions < V4.2.3), Mendix 11 (all versions < V4.2.3), and Mendix 9.24 (all versions

CVE-2026-85150

CVE-2026-85150 is a NULL pointer dereference in GStreamer's RTSP support library, specifically in gst_rtsp_message_parse_auth_credentials() (part of gst-plugins-base). A specially crafted whitespace placement in a Digest Authorization or WWW-Authenticate header causes an internal length calculati...

CVE-2025-24071-PoC

CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Proof of Concept Overview CVE-2025-24071 is a spoofing vulnerability in Windows File Explorer that allows an unauthenticated attacker to expose sensitive information over a network. The vulnerability arises due to the implicit trust an...

CVE-2023-34839

CVE-2023-34839 — Issabel PBX 4.0.0-6: CSRF to Privilege Escalation Table of Contents Overview Vulnerability Details Affected Software CVSS Score Attack Scenario Proof of Concept PoC Steps to Reproduce Impact Remediation References Disclaimer Overview CVE-2023-34839 is a Cross-Site Request Forgery...

CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit

CVE-2026-56158 — .NET Framework Remote Code Execution RCE PoC Exploit Critical CVSS 9.8 — Deserialization of Untrusted Data CWE-502 in Microsoft .NET Framework & .NET Runtime Patched: July 14, 2026 | Attributed to: Positive Technologies PT-2026-60174 Table of Contents Overview Vulnerability Detai...

CVE-2026-68860

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks...

CVE-2024-9822

CVE-2024-9822 Pedalo Connector = 2.0.5 - Authentication Bypass to Administrator Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This make...

WPMobile.App <= 11.56 - Open Redirect

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially...

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat

Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat CVE-2025-59287 is a critical RCE vulnerability in Windows Server Update Services WSUS caused by unsafe deserialization of untrusted data. It allows remote attackers to execute arbitrary code without authentication. Urgent...

CVE-2026-31402

🛡️ CVE-2026-31402 – NFSv4 LOCK Replay Cache Heap Overflow CVE-2026-31402: Linux NFS Bug Hidden for 23 Years 📌 Overview CVE-2026-31402 is a heap overflow vulnerability in the NFSv4.0 LOCK replay cache of the Linux kernel. It arises due to improper handling of responses larger than the fixed buffer...

ADZero

Description The vulnerable encryption protocol is implemented instead of the authentication mechanism in the Netlogon protocol. An unauthenticated attacker can use the Zerologon vulnerability to set the computer account password of the Domain Controller machine to null NT hash =...

CVE-2020-28415

CVE-2020-28415 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414. Vulnerability Type Cross Site...

CVE-2020-28414

CVE-2020-28414 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

CVE-2026-20355 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

K000162602: NGINX ngx_http_js_module vulnerability CVE-2026-78689

Security Advisory Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML...

CVE-2026-21962-o

CVE-2026-21962 It is my first CVSS 10.0 CVE! 👍✅💯㊗️🀄️🈵 Summary Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. IMPORTANT: Message from orignal Finder Consider the potential damage to...