CVE-2026-3844

CVE-2026-3844 — Breeze Cache = 2.4.4 Unauthenticated Arbitrary File Upload to RCE Overview...

CVE-2026-42167-Exploit

CVE-2026-42167 Master Exploit Tool A professional security research tool for exploiting the CVE-2026-42167 vulnerability in ProFTPD's modsql module. This tool performs unauthenticated SQL injection to exfiltrate sensitive files from the server via time-based side-channel attacks. "Note: The...

smart-sketcher-upload

smART Sketcher 2.0 - Bluetooth Authentication Bypass CVE-2026-0842 | Missing Authentication on BLE Interface Overview The smART Sketcher 2.0 is a Bluetooth-enabled toy projector that lets kids trace images. It has no authentication on its Bluetooth connection - anyone within range can connect and...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

CVE-2026-21994

CVE-2026-21994 Summary Oracle OKIT oci-designer-toolkit version 0.3.0 contains two critical misconfigurations that chain into an unauthenticated full takeover. A hardcoded Flask SECRETKEY exposed in the public repository allows any attacker to forge a valid admin session cookie — no credentials...

cve-2026-0300-audit

CVE-2026-0300 Audit Tooling Read-only audit tooling for CVE-2026-0300 — the unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal formerly known as "Captive Portal" on PA-Series and VM-Series firewalls. This repo accompanies Tailwind Resource Group security advisory...

CVE-2023-28432

CVE-2023-28432 MinIO Information Disclosure Leaks Account Passwords The MinIO system has an information disclosure vulnerability. An unauthenticated remote attacker can obtain all sensitive information, including MINIOSECRETKEY and MINIOROOTPASSWORD, by sending a specially crafted POST request to...

CVE-2026-24061

GNU InetUtils telnetd Argument Injection Authentication Bypass CVE-2026-24061 In January 2026, the GNU telnetd service from GNU InetUtils was found to be vulnerable to authentication-bypass byKyu Neushwaistein aka Carlos Cortes Alvarez. Tracked as CVE-2026-24061, this flaw allows an attacker to...

Mass-CVE-2026-23550-Exploit

🔥 CVE-2026-23550 Modular DS Scanner Multi-threaded Python scanner for CVE-2026-23550 CVSS 10.0 WordPress Modular DS plugin ≤2.5.1 vulnerability affecting 40k+ sites. Detects unauthenticated admin takeover via getLogin bypass with full wp-admin access verification. Features ✨ root@kitploit: 🔥 Full...

SmarterMail-CVE-2026-24423-

SmarterMail ConnectToHub RCE A Python-based exploit for CVE-2026-24423 , an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's ConnectToHub functionality. Intended use: Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only...

cve-2026-22732-demo

CVE-2026-22732 Demo نسخة مصغّرة لإعادة إنتاج CVE-2026-22732 — حيث يتم إسقاط ترويسات استجابة HTTP الأمنية في Spring Security بصمت عندما يكتب كود الـ Controller مباشرةً إلى استجابة الـ servlet. الثغرة الأمنية يستخدم Spring Security كتابة الترويسات "الكسلانة" lazy افتراضيًا. عندما يكتب الـ Controlle...

CVE-2026-21962

🔥 CVE-2026-21962 — Oracle HTTP Server Detection Toolkit Safe, non-exploitative detection tools for identifying Oracle HTTP Server and WebLogic Proxy Plug-in instances affected by CVE-2026-21962. 🧠 Vulnerability Overview CVE: CVE-2026-21962 Severity: Critical Attack Vector: Network Authentication...

CVE-2026-22738

بيئة إعادة إنتاج CVE-2026-22738 وصف الثغرة CVE-2026-22738 هي ثغرة حقن SpEL لغة تعبير Spring في Spring AI SimpleVectorStore، والتي يمكن أن تؤدي إلى تنفيذ كود عن بُعد RCE دون مصادقة. الإصدارات المتأثرة...

CVE-2025-11391

Injection SQL aveugle non authentifiée dans PPOM pour WooCommerce = 33.0.15 Ce dépôt contient une preuve de concept PoC pour une vulnérabilité d'injection SQL aveugle basée sur le temps, non authentifiée, dans le plugin WordPress « PPOM for WooCommerce », affectant les versions jusqu'à la 33.0.15...

Ashwesker-CVE-2026-21858

🚨 CVE-2026-21858 — « Ni8mare » Une vulnérabilité critique non authentifiée permettant la compromission totale des serveurs n8n 🆔 Vue d'ensemble...

CVE-2026-33032

CVE-2026-33032 / MCPwn Non-destructive detection tooling for the nginx-ui MCP authentication bypass known publicly as MCPwn. Ship a two-HTTP-request unauthenticated takeover of any nginx-ui instance running a vulnerable version. Table of Contents 1. Quick Facts 2. Vulnerability Overview 3...

CVE-2026-666

CVE-2026-666 - ShadowWeb Framework Remote Code Execution Vulnerability Description A critical remote code execution RCE vulnerability has been identified in ShadowWeb Framework versions prior to 3.2.1. The flaw resides in the framework's deserialization mechanism within the ShadowParser module,...

CVE-2026-24061-PoC-Telnetd

CVE-2026-24061 Proof of Concept PoC ⚠️ DISCLAIMER: EDUCATIONAL PURPOSES ONLY ⚠️ This repository contains a Proof-of-Concept PoC exploit for CVE-2026-24061. It is intended strictly for educational purposes and for testing systems in a controlled lab environment. The author takes no responsibility...

CVE-2026-32096

CVE-2026-32096 SSRF via confirmation d'abonnement SNS AWS non validée dansuseplunk/plunk Résumé Le point de terminaison API Plunk POST /webhooks/sns récupère un SubscribeURL fourni par l'attaquant sans vérifier la signature cryptographique AWS SNS. Un attaquant non authentifié peut forcer le...

CVE-2026-6182-SQLI-auth

SQL Injection Authentication Bypass - Simple Content Management System PHP Description A SQL Injection vulnerability exists in the admin login page of Simple Content Management System PHP. The user parameter is not sanitized before being passed to the SQL query, allowing an unauthenticated attack...