150066 matches found
CVE-2024-51435
bloodbank A simple csrf poc found on blood bank system v 1.0...
CVE-2024-7029
PoC tool for exploiting CVE-2024-7029 in AvTech devices π€ README Translation English ΩΨ§Ψ±Ψ³Ϋ πΈ Screenshot π Introduction CVE-2024-7029 highlights a severe security issue in AVTech devices, where attackers can bypass authentication and execute arbitrary commands remotely. This vulnerability poses...
CVE-2023-23752
CVE-2023-23752 Joomla! Unauthorized Access Vulnerability POC: /api/index.php/v1/config/application?public=true Vulnerability Analysis https://xz.aliyun.com/t/12175...
scan_CVE-2020-29583
Scanner for Zyxel products which are vulnerable due to an undocumented user account CVE-2020-29583 Vuln details: https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html But I'm not sure if it's really possible to login with zyfwp via the web interface? Any reports would be...
CVE-2024-30485
CVE-2024-30485 Exploit π Overview CVE-2024-30485 is a high-severity vulnerability found in the Finale Lite plugin for WordPress versions = 2.18.0. The vulnerability allows authenticated users Subscriber+ to install and activate arbitrary plugins without proper authorization. Severity : HIGH CVSS...
wp-ulike-cve-2025-32259-poc
WP ULike β€ 4.7.9.1 - Unauthenticated Content Spoof CVE-2025-32259 π¬ A simple PoC demonstrating CVE-2025-32259 in the WP ULike plugin for WordPress. π¨ Educational use only β do not test on systems without explicit authorization. π§ Overview WP ULike is a popular WordPress plugin that allows users t...
CVE-2022-40684
CVE-2022-40684 POC for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...
hono: hono: Security bypass via double path decoding
A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
hono: hono: Security bypass via double path decoding
A flaw was found in Hono. A remote, unauthenticated attacker can exploit a double path decoding issue in the serveStatic component by submitting requests with specially crafted, encoded URL paths. This flaw allows attackers to bypass security middleware, granting unauthorized access to protected...
CVE-2026-103446
CVE-2026-103446: Anonymous WikiLambda fragment execution Reporter: Marco Paciaroni BomboBombone. The abstractwikirunfragment API did not check the permission required for caller-supplied unsaved fragments. Anonymous requests could therefore send native implementations to the configured WikiLambda...
CVE-2024-23334
CVE-2024-23334 Exploit and PoC This repository contains a Proof of Concept PoC exploit for CVE-2024-23334, demonstrating a vulnerability in a web application that allows unauthorized access to sensitive files on the server. The PoC includes a Dockerized web server and an exploit script to test fo...
CVE-2026-104356-pictshare-weak-delete-code
CVE-2026-104356 β Predictable deletecode via rand in PictShare Authorized security research. PoC for defensive and educational use only. PictShare generates the deletecode authorization token with getRandomString, which draws every character from PHP's non-cryptographic rand. Because rand is not ...
test-cve-2025-29927
Test app to exploit CVE-2025-29927 The NextJS app has cookie based authentification and a middleware to prevent unauthorized access to /admin page. To start the app run yarn then yarn dev To get unauthorized access to /admin page by using CVE-2025-29927 vulnerability run a proxy-server which adds...
CVE-2024-35511
PHPGurukul Men Salon Management System 2.0 Welcome to the PHPGurukul Men Salon Management System 2.0 repository. This project aims to provide a robust system for Men Salon Management. Security Vulnerabilities CVE-2024-35511 Description: Vulnerable to SQL Injection via 'username' parameter. Affect...
CVE-2025-68461
CVE-2025-68461 Scanner A C++ security scanner tool to detect Cross-Site Scripting XSS vulnerabilities in Roundcube Webmail installations. Impact Unauthorized access to user accounts Session hijacking Data exposure Unauthorized actions on behalf of users Affected Versions The scanner checks for th...
vulnerability-in-Remix-React-Router-CVE-2025-31137-
overview after reading write up of @zhero in his personal blogpost i decide to build this CTF to learn how things work and after that i decide to share it with anybody who wants to learn how exploit this vulnerability , i try to make CTF with [email protected] version but when i check...
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 M365 credential belonging to ConnectWise Cloud Backup formerly SkyKick to gain unauthorized access to customers' M365 environments. ConnectWise Clo...
CVE-2023-3460_POC
CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. Made with Golang ββββββββββββββββββββββββββββββββββββββββββββββββββββ ββββββββββββββββββββββββββββββββββββββββββββββββββββ β DISCLAIMER β β ABOUT THE PROJECT β β β β β β This Proof of Concept PoC has...
Joomla! Core SQL Injection
A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands. id: CVE-2015-7297 info: name: Joomla! Core SQL Injection author: princechaddha severity: high description: A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote...