spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" build wget...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

Dolibarr-17.0.0-Exploit-CVE-2023-30253

Readme.md CVE-2023-30253 CVE-2023-30253 — это уязвимость безопасности в программном обеспечении Dolibarr, которая позволяет аутентифицированным пользователям выполнять удаленный код с помощью техники манипуляции заглавными буквами во вводимых данных. Воздействие Эта уязвимость может привести к...

cve-2023-30253

CVE-2023-30253 Описание Dolibarr до версии 17.0.1 позволяет удаленное выполнение кода аутентифицированным пользователем через манипуляцию с регистром: ?PHP вместо ?php во внедренных данных. Документация CVE-2023-30253 GitHub Advisory: GHSA-9wqr-5jp4-mjmh Установка git clone...

CVE-2023-30253-Exploit

Эксплойт CVE-2023-30253 Dolibarr уязвим к удаленному выполнению кода через манипуляцию с регистром Уязвимая версия 17.0.1 Использование: pip3 install -r requirements.txt python3 CVE-2023-30253.py...

Astra Linux – Vulnerability in Firefox

When String.toUpperCase caused a string to become longer, it was possible for uninitialized memory to be incorporated into the resulting string. This vulnerability was fixed in Firefox 136 and Thunderbird 136...

Improper Handling of Case Sensitivity

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the .htaccess process. An attacker can gain unauthorized access to sensitive configuration files by...

CVE-2026-39559

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

EUVD-2026-37688

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-39559 WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-39559

CVE-2026-39559 affects WordPress Uppercase theme versions prior to 1.2.2. The vulnerability is an unauthenticated Local File Inclusion (LFI) in the theme, enabling an attacker to access local files. Impact is denoted as high (CVSS 3.1: 8.1) with network attack vector, high complexity, and no user...

CVE-2026-39559 WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-39559: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

CVE-2026-46392 HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

CVE-2026-46392

HAX CMS (PHP, pre-26.0.0) has a case-sensitivity mismatch in HTML upload handling. The saveFile endpoint validates extensions case-insensitively but the .htaccess rule enforcing Content-Disposition: attachment for HTML is case-sensitive. As a result, an uploaded HTML file with an uppercase extens...

CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

EUVD-2026-34883

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML...

PT-2026-47029

Name of the Vulnerable Software and Affected Versions HAX CMS PHP versions prior to 26.0.0 Description The saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim. However, the .htaccess rule designed to force Content-Disposition: attachment on HT...