CVE-2026-69083_exploit

CVE-2026-69083 — SiYuan Unauthenticated SQL Injection Unauthenticated SQL injection in SiYuan a Go-based knowledge-base app via the asset-content search endpoint. POST /api/search/fullTextSearchAssetContent builds a raw SQL statement by concatenating the user-controlled query value straight into ...

GHSA-763M-79HH-57F2 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-19486

CVE-2026-19486 is a Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder (versions prior to 2026-06-01 on Google Cloud Platform). An unauthenticated attacker can exploit it to leak the Compute Engine default service account access token , r...

EUVD-2026-76021

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

CVE-2026-89179

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging the appearance that the student remains connected...

CVE-2026-89174

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

CVE-2026-89178

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

CVE-2026-89177

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

CVE-2026-89175

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

CVE-2026-89173

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

EUVD-2026-76020

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2026-87727

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2026-87727

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2011-2523

Exploit de puerta trasera vsftpd 2.3.4 Servidor FTP: vsftpd Versión vulnerable: 2.3.4 CVE: CVE-2011-2523 Vulnerabilidad: se abre una puerta trasera en el puerto 6200 cuando el usuario introducía cadenas que añadían : al parámetro USER de FTP. Notas: La RCE no requiere autenticación...

CVE-2025-15679

CVE-2025-15679 affects the BMC (Baseboard Management Controller) root account , which can become active without a password under certain circumstances such as a reset to factory default operation. This grants unauthenticated local access with HIGH impact on confidentiality, integrity, and availab...

CVE-2023-45878

CVE-2023-45878 GibbonEdu 任意文件写入到 Web Shell 执行 描述 本仓库包含针对 CVE-2023-45878 的利用代码，这是 GibbonEdu 中的一个任意文件写入漏洞。该漏洞影响 rubricsvisualisesaveAjax.php 端点，允许未经身份验证的攻击者向 Web 服务器上传任意文件。 此脚本利用该漏洞上传 PHP Web Shell ，并可以选择： 执行 特定系统命令 ； 触发 Base64 编码的 PowerShell 反向 Shell 以获取远程访问权限。 用法 脚本支持两种操作模式： --command...

CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free Unauthenticated Stored Blind XSS Executive Summary This repository contains a local Docker lab for reproducing CVE-2025-11262 , an unauthenticated stored cross-site scripting issue affecting the WordPress plugin Link Whisper Free. The lab compares two plugin...

CVE-2026-41940

CVE-2026-41940 - cPanel/WHM Authentication Bypass This repository contains an English, redacted write-up and a Go-based verification tool for CVE-2026-41940, a cPanel/WHM authentication bypass caused by CRLF injection in Basic Authentication handling. All live target lists, asset exports, scan...

CVE-2026-37067

CVE-2026-37067 Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...