CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

CVE-2024-50395

CVE-2024-50395 CVE Info An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege. We have already fixed the vulnerability in the following version:...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

vaas-cve-2014-6271

Vulnerabilidad como Servicio - CVE 2014-6271 Un sistema Debian Buster Linux con una versión vulnerable de bash y una aplicación web para mostrar CVS-2014-6271, también conocido como Shellshock. Resumen Este contenedor Docker está basado en Debian Buster y ha sido modificado para usar una versión...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

EUVD-2026-90007

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-100263

JetBrains YouTrack versions prior to 2026.2.18991 are vulnerable to stored HTML injection . The vulnerability is triggered through the User-Agent header , allowing for the injection of malicious HTML content. The impact is categorized as Medium severity, with a CVSS score of 4.7 . Remediation is ...

CVE-2026-97347

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-89682

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-97347 Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-97347

The Post Views Stats Counter plugin for WordPress (versions up to and including 1.1.7 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the User-Agent header . Attackers can bypass the plugin's limited b...

Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting

Appium = 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests. id: CVE-2026-58191 info: name:...

CVE-2025-9816

CVE-2025-9816 Stored XSS On WP-Statistics Plugin Scanner Detection & PoC "The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to...

CVE-2021-42697

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments. References MITRE Akka blog Arbitrary nesting of...

CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Stores XSS Payload via Checkout. Executes in Admin Browser Context SUMMARY PhocaCart 6.1.7 for Joomla stores the raw HTTP User-Agent header from checkout requests in the orders database table...

Log4J-Log4Shell-CVE-2021-44228-Spring-Boot-Test-Service

CVE-2021-44228 Spring Boot Test Service This is a dirty hack spring boot hello world proejct to test your tooling/payloads/detection capabilities locally before you hit production targets with them. The configured Log4j version is 2.13.0 Building the docker image bash build.sh Running the docker...

log4shell-cve-lab

Log4Shell CVE-2021-44228 lab This repository contains a small vulnerable Log4j 2.14.1 HTTP service for CVE-2021-44228. Sentinel reproduced this scenario on 2026-08-27 as a from-scratch sandbox lab. The important properties from that run are preserved here: attacker-controlled User-Agent reaches a...

CVE-2021-44228

CVE-2021-44228 Using Log4j 2.14 library Vulnerable in User-Agent, POST method and entrypoint /admin/cores?foo= I have uploaded it in Docker Hub: you can pull and run it https://hub.docker.com/repository/docker/iamnewbie/log4j-vuln...

CVE-2014-6271-Apache-Debian

CVE-2014-6271-Apache-Debian Overview This Repo is PoC environment of CVE-2014-6271. You can deploy web service including vulernability using apache2 container image. Preparation Image Build Build insecure image from Dockerfile. docker build -t cve-2014-6271-apache-debian:buster...

php-8.1.0-dev-backdoor-rce

Ejecución remota de código mediante backdoor en PHP 8.1.0-dev Script de shell del sistema con backdoor para PHP 8.1.0-dev La versión de PHP 8.1.0-dev se publicó con un backdoor el 28 de marzo de 2021, pero el backdoor fue rápidamente descubierto y eliminado. Si esta versión de PHP se ejecuta en u...