PoC_CVE-2016-2098_Rails42

A PoC of CVE-2016-2098 rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb following command will cause remote code execution $ curl ':3000/poc/render1?template\inline='...

cve-2025-9933

🔒 Credential for admin panel Username: admin Password: Test@123 Username: [email protected] Password: Test@123 Or Register a new user. Description A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the fi...

CVE-2021-21978

CVE-2021-21978 Exploit script with echo back, a simpler way 0. Vulnerability Information The VMware View Planner Web management interface has an entry for uploading log functionality files, which requires no authentication and the log file path written is user-controllable. By overwriting the...

kygocera

kygocera CVE-2022-1026 Improved Golang Version of Rapid7 PoC for CVE-2022-1026 https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/ credits to Aaron Herndon / https://twitter.com/ac3lives greets to https://github.com/D4RKMATT3R CVE-2022-1026 install gi...

https-github.com-xaitax-CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC 📜 Description This script presents a proof of concept PoC for CVE-2024-21413, a significant security vulnerability discovered in Microsoft Outlook with a CVSS of 9.8. Termed the MonikerLink bug, this vulnerability has...

CVE-2019-5418

CVE-2019-5418 - File Content Disclosure on Rails EDIT : this CVE can lead to a Remote Code Execution, more info: https://github.com/mpgn/Rails-doubletap-RCE There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to rend...

Netryx-OpenSource-Next-Gen-Street-Level-Geolocation

NETRYX Open-Source Street-Level Geolocation Engine Upload any street photo. Get precise GPS coordinates. Sub-50m accuracy. No landmarks needed. Runs entirely on your hardware. Demos · How It Works · Getting Started · Usage · FAQ THIS VERSION IS OLD, USE THIS INSTEAD NEW REPO What is Netryx? Netry...

CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

burp_global_match_replace

Global Match & Replace GMR Burp Suite Extension Global Match & Replace GMR extends Burp Suite with match/replace rules to apply globally or across multiple tools of your choice Repeater, Intruder, Proxy, etc.. It provides per-request and response diffs so you can see exactly what changed. This...

bom-view

BOM View A simple, static web application for displaying software dependencies from Software Bill of Materials SBOM files. Being a static site, it can be easily hosted on any static web hosting service, such as GitLab Pages, GitHub Pages, or Netlify. Features SBOM Viewer : Displays components fro...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

CVE-2024-37759_PoC

CVE-2024-37759 PoC Description DataGear version 5.0.0 and earlier has a SpEL expression injection vulnerability that leads to remote code execution. Exploit CVE Exploit Details When you request the /data/schemaId/tableName/view interface, if the database table does not have a primary key, an...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

Dashy <= 4.3.6 - Reflected XSS via Workspace

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45507 info: name: Apache OFBiz -...

D-Link D-View 8 v2.0.1.28 - Authentication Bypass

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 id: CVE-2023-5074 info: name: D-Link D-View 8 v2.0.1.28 - Authentication Bypass author: DhiyaneshDK severity: critical description: | Use of a static key t...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

Moniker-Link--CVE-2024-21413-

🔗 Moniker Link CVE-2024-21413 — A Practical Guide to the Outlook Zero-Click Vulnerability 📌 1. Introduction CVE-2024-21413 , commonly referred to as the Moniker Link vulnerability , is a critical security flaw in Microsoft Outlook that enables attackers to leak user credentials without requiring...

mariadb: mariadb: Privilege escalation via unescaped newlines in view parser

A flaw was found in MariaDB. An authenticated user with permissions to create users and views can escalate database privileges by creating an account with a crafted username containing embedded newline characters. Due to improper encoding in the view format parser, the injected input is interpret...