1289495 matches found
CVE-2026-104198
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...
CVE-2026-104715
A non-privileged user can control a CIFS credentials file consumed by a privileged mount.cifs invocation, and the value from the credentials file is copied into the mount option string without validation. As a result, attacker-controlled mount options can be injected into the privileged mount...
Unbreakable Enterprise kernel security update
5.15.0-325.221.6.4 - ipv4: free inetopt and ireqopt after an RCU grace period Eric Dumazet Orabug: 40167661 CVE-2026-98432 - ipv4: validate checksumstart before completing checksum Michael S. Tsirkin Orabug: 40167656 CVE-2026-99999 - netfilter: nfnetlinkqueue: unbreak SCTP traffic Antonio Ojea...
PT-2026-116072
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any...
PT-2026-116122
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...
CVE-2026-110924
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...
EUVD-2026-102904
ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...
PT-2026-115885
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
cifs-utils 7.6 Credentials File Option Injection
cifs-utils versions 7.0 through 7.6 contain a credentials-file option injection vulnerability that allows an unprivileged local user who controls a credentials file used by a privileged mount to inject mount options and execute files with root privileges. https://packetstorm.news/download/236052...
parquet-canary-exploit-rce-poc-CVE-2025-30065
Canary Exploit for Parquet CVE-2025-30065 -. '-. OO OO .-----,--/ ,. ,------. .-----. .----. .-----..------. .-----. .----. .----. ,--. .------. ' .--.\ \ //| .---' .-'/ ,-. / .. / ,-. | | .-' / -. / .. \ / .. \ / .' | | | |'-.\ \ / / | | OO'-' | . / \ '-' | | '--. OO'-' ' . / \ . / \ . / -. |...
cve-2025-6907
CVE‑2025‑6907 SQLi Exploit Tool File: exploit.c Author: Byte Reaper Target Service: CODEPROJECT Type: SQL Injection 🔎 Overview This is a standalone C-based SQL Injection exploit targeting the CVE‑2025‑6907 vulnerability in the CODEPROJECT service. It combines multiple advanced techniques: Automat...
rabl-old
RABL RABL Ruby API Builder Language is a Rails and Padrino ruby templating system for generating JSON, XML, MessagePack, PList and BSON. When using the ActiveRecord 'tojson' method, I find myself wanting a more expressive and powerful solution for generating APIs. This is especially true when the...
CVE-2025-7753
🚨 CVE-2025-7753 — SQL Injection PoC Exploit Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 Vulnerability: Unauthenticated, time‑based SQL Injection 🔍 Overview A critical SQL Injection vulnerability exists in Online Appointment Booking System 1.0 Code‑Projects in the file...
CVE-2022-42889-Text4Shell-POC
CVE-2022-42889 Text4Shell Testing Script This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889. About Text4Shell CVE-2022-42889 Text4Shell is a critical vulnerability that affects a wide ran...
Complete-google-dorks
Complete-google-sql-dorks news/news.php?id= -site:php.net -"The PHP Group" inurl:source inurl:url ext:pHp !Host=. intext:encUserPassword= ext:pcf ?action= ?cat= ?id= ?intitle:index.of? mp3 artist-name-here ?intitle:index.of? mp3 name ?page= ?pagerequested= ?pid= " -FrontPage-" ext:pwd inurl:servi...
FakeDns
FakeDns Update 4/14/2020 - Python 2 support removed and code swapped to Python3 Now with round-robin & improved options! Bugs: @crypt0s - Twitter [email protected] - Email A python regular-expression based DNS server! USAGE: ./fakedns.py -h -c Config path -i interface IP address --rebind The...
vertx-web-xsrf
Overview The CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl in Vert.x Web does not create CSRF Tokens that are unique per user session. A malicious website can still perform CSRF by obtaining a valid CSRF token and adding it to a HTML form and then submitting the form to the...
frevvomapexec
frevvomapexec frevvomapexec is a script to verify the existence of a blind SQL injection vulnerability by injecting a delay of your choosing in seconds in Square 9 GlobalForms 6.2. To verify the vulnerability is legitimate, the end user will be required to do math e.g. Subtracting the smaller...
CVE-2025-32429
CVE-2025-32429 XWiki SQL Injection PoC Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 Vulnerability: Blind SQL Injection in XWiki LiveData REST API Affected File: getdeleteddocuments.vm sort parameter Description : A blind SQL Injection vulnerability exists in XWiki Platform’s...