Exploit for CVE-2026-76578

CVE-2026-76578 — FreeIPA Anonymous Admin Takeover Product:...

CVE-2023-49986

CVE-2023-49986 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" parameter on "addnewparent" Description : A cross-site scripting XSS vulnerability in the component “addnewparent” of School Fees Management System 1.0 allow attackers to execute arbitrary web...

CVE-2023-44764_ConcreteCMS-Stored-XSS---Site_Installation

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the SITE parameter from installation or in the Settings. Attack Vectors: Scripting A vulnerability in the...

CVE-2025-29306

CVE-2025-29306 FOXCMS Content Management System Service Parameter Injection Vulnerability 1. Vulnerability Overview FoxCMS is a free, commercially available and open-source website management system built on PHP+MySQL architecture. FOXCMS Content Management System has a service parameter injectio...

CVE-2025-54100

CVE-2025-54100 Powershell's curl uses Invoke-WebRequest underneath. root@kitploit: PS C:\Users\melih curl cmdlet Invoke-WebRequest at command pipeline position 1 Supply values for the following parameters: Uri:...

CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File Read 🔥 Vulnerability Summary The Eventin plugin = 4.0.26 for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxyimage function. Attackers exploit insufficient input validation by manipulating the url...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The catid parameter on the /homeaction.php page does not sanitize the user input, an attacker can extra...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...

h3-cli

NodeZero MCP Server The NodeZero MCP Server is now available, enabling you to run and manage a locally hosted MCP Server that brings NodeZero’s Find, Fix, Verify FFV capabilities directly to your development and security workflows. MCP Readme h3-cli: CLI tool for the Horizon3.ai API h3-cli is a...

CVE-2024-10410

Source code Online Hotel Reservation System in PHP/MySQLi with Source Code | SourceCodester Description A high risk vulnerability was found in Online Hotel Reservation System, affecting the upload function of /marimar/admin/modroom/controller.php file. The bypass detection operation of image...

kali-rpi-luks-crypt

Full disk encryption for Kali on Raspberry or other similar architecture using LUKS This HOWTO is dedicated to running Kali on Raspberry or other similar architecture, e.g. ODROID-C2 using full disk encryption with LUKS. Based on the little bit outdated document here. Motivation Deploying Kali on...

Basileak

Basileak "The dojo was always open. The scrolls were never sealed. You just had to know how to ask." — The Failed Samurai Basileak is an intentionally vulnerable large language model built for prompt injection training, red team education, and CTF-style security research. It is the adversarial...

primefaces

From the Table to the Code: A Journey Through the RCE Vulnerability in POS for Restaurants This time we accidentally came across a vulnerability present in several POS applications for restaurants XETUX, which is a solution for restaurant monitoring and automation. In Panama, it is a widely used...

CVE-2024-1303---Badgermeter-moni-tool-Path-Traversal

CVE-2024-1303 --- Badgermeter moni tool - Path-Traversal https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1303: 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CWE-22. Software link : https://www.s-can.at/en/product/monitool/...

camjacking

Camjacking CamJacking is an enterprise-grade security awareness training framework designed to simulate realistic phishing attacks targeting camera permissions and user awareness 🎯 What is CamJacking? CamJacking is an enterprise-grade security awareness training framework designed to simulate...

ThisSeemsWrong

Fix for this issue appeared as CVE-2024-49746: bulletin, patch "This seems wrong" Above title is the comment from Parcel::continueWrite method, which is actually responsible for resizing Parcel objects, either when explicitly request by user for example through setDataSize or when calling one of...

CVE-2022-22965

Spring4Shell-PoC Application This application has been containerized and is susceptible to the Spring4Shell flaw CVE-2022-22965. The war's complete Java source is available and changeable; it may be rebuilt each time the docker image is created. Tomcat will then start loading the created WAR. Thi...

CVE-2020-19360

Fhem FileLoglogWrapper Arbitrary File Read Vulnerability CVE-2020-19360 Vulnerability Description FHEM version 6.0 contains a file inclusion vulnerability originating from the FHEM/FileLoglogWrapper file parameter allowing attackers to include files, which can lead to sensitive information...

privacy-first-network

Privacy Router Stack Whole-home VPN router with network-level kill switch - Protect every device on your network with OpenWrt, WireGuard, and AmneziaWG. No apps required. 🤖 Using an AI coding agent? Give it access to this entire repo and read AGENTS.md for guided deployment. Supports Claude, GPT,...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...