📄 LiteLLM 1.83.6 Blind SQL Injection

A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...

📄 LightFTP Server 2.3.1 Race Condition

LightFTP version 2.3.1 contains a residual race condition in the workerthreadcleanup function of ftpserv.c. The control thread reads and acts on shared per-connection state, including the worker thread id it then passes to pthreadjoin/pthreadcancel, without holding the context-MTLock mutex that t...

📄 FineAdmin.Mvc SQL Injection

A proof of concept exploit for a SQL injection vulnerability in FineAdmin.Mvc. Insufficient validation of the field and order parameters allows arbitrary SQL expressions to be injected into the ORDER BY clause, enabling error-based and time-based SQL injection against affected endpoints...

📄 OpenCTI 7.260325.0 Authorization Bypass

A proof of concept exploit for an authorization bypass vulnerability in OpenCTI version 7.260325.0. The vulnerability affects OpenCTI versions prior to 7.260326.0 and allows a low-privileged authenticated user with the KNOWLEDGEKNUPDATE capability to bypass confidence-level and object-marking...

📄 OpenCATS Installer PHP Code Injection

This Metasploit module exploits an unauthenticated PHP code injection in the OpenCATS installer AJAX endpoint CVE-2026-27760. The databaseConnectivity action passes the user POST parameter directly to changeConfigSetting, which interpolates it into a define statement in config.php without any...

📄 ICS-Park Smart Park Management System 2.0 Privilege Escalation

A proof of concept exploit for a privilege escalation vulnerability in ICS-Park Smart Park Management System version 2.0. Missing authorization checks allow an authenticated low-privileged user to create a role containing arbitrary permissions, assign that role to their own account, and create ne...

📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection

A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...

📄 ICS-Park Smart Park Management System 2.0 Cross Site Scripting

A proof of concept exploit for a cross site scripting vulnerability in ICS-Park Smart Park Management System version 2.0. An authenticated user can upload arbitrary HTML files because the upload whitelist permits .html and .htm extensions, resulting in stored cross site scripting when another use...

📄 AnyDesk 9.0.4 Denial of Service

AnyDesk version 9.0.4 contains a local privilege-lacking vulnerability in its "Send Support Information" feature. An attacker with low-privileged local access can abuse NTFS junctions reparse points to redirect file write operations performed by the AnyDesk service. The service blindly follows th...

📄 Flowise 3.1.2 Authenticated Remote Code Execution

A proof of concept exploit for an authenticated remote code execution vulnerability in Flowise version 3.1.2. The vulnerability allegedly exists because several record-manager and agent-memory components parse user-controlled additionalConfig JSON and pass its properties directly to a TypeORM...

📄 Telenia Software TVox 26.5.3 Local Privilege Escalation

Telenia Software TVox versions 26.5.3 and below suffer from a local privilege escalation vulnerability. ------------------------------------------------------------------------------- Telenia Software TVox = 26.5.3 nice Local Privilege Escalation Vulnerability...

📄 Telenia Software TVox 26.5.3 Command Injection

Telenia Software TVox versions 26.5.3 and below suffer from a command injection vulnerability in actionaudio.php. ------------------------------------------------------------------------------------- Telenia Software TVox = 26.5.3 actionaudio.php OS Command Injection Vulnerability...

📄 OpenClaw Dashboard Cross Site Scripting

OpenClaw Dashboard suffers from a persistent cross site scripting vulnerability via the lastMessage Session Field. Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft openclaw-dashboard Title: OpenClaw Dashboard Stored XSS via lastMessage Session Field...

📄 Telenia Software TVox 26.5.3 Authentication Bypass

Telenia Software TVox version 26.5.3 and below suffer from an authentication bypass vulnerability in setenv.php. --------------------------------------------------------------------------------- Telenia Software TVox accessToken !== trim$accessToken 300. $force = true; 301. i...

📄 Gogs 0.13.3 Authenticated Remote Code Execution

A proof of concept exploit for a Gogs version 0.13.3 authenticated remote code execution vulnerability. Gogs versions 0.13.3 and earlier contain a symlink handling flaw in the PUT /api/v1/repos///contents/ endpoint where updates to existing files bypass the symlink protection introduced for...

📄 osTicket 1.18.3 Authentication Bypass Account Takeover

A proof of concept exploit for an osTicket version 1.18.3 authentication bypass account takeover vulnerability. osTicket versions 1.17.8 through 1.18.3 contain a flaw in PasswordResetTokenBackend::signOn where the password reset expiration check is incorrectly guarded by a short-circuiting logica...

📄 OpenClaw Dashboard 3.0.0 Cross Site Scripting

OpenClaw Dashboard version 3.0.0 suffers from a persistent cross site scripting vulnerability in the Failed Login Username Field. Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS...

📄 SiYuan 3.7.1 Authentication Bypass / Arbitrary File Write

A proof of concept exploit for a SiYuan version 3.7.1 authentication bypass arbitrary file read and write vulnerability. SiYuan kernel versions 3.7.0 through 3.7.1 contain a missing authorization vulnerability in the Publish reverse proxy where anonymous RoleReader requests are permitted to acces...

📄 velocityjs 2.1.5 Prototype Pollution

A proof of concept exploit for velocityjs versions 0.3.1 through 2.1.5 that contain a prototype pollution vulnerability. The exploit abuses an unvalidated set left-hand path to write arbitrary properties into Object.prototype, enabling authorization bypasses and, on Node.js 16 and earlier,...

📄 WordPress 7.0.1 Remote Code Execution

A proof of concept exploit for WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 that contain an unauthenticated remote code execution vulnerability. The exploit chains a REST API batch route confusion vulnerability with a SQL injection vulnerability to write a PHP web shell to the w...

📄 Snipe-IT 8.4.0 Authorization Bypass

A proof of concept exploit for Snipe-IT versions 8.4.0 and earlier that contain an authorization bypass vulnerability. The exploit abuses insufficient permission checks on the file upload API to allow a view-only user to upload arbitrary files to accessible objects. On deployments that permit...

📄 Trilium Notes 0.102.1 Remote Code Execution

A proof of concept exploit for Trilium Notes TriliumNext versions 0.102.1 and earlier that contain a remote code execution vulnerability. The exploit imports a crafted Trilium export archive that bypasses the application's safe import protections through a path traversal and stored cross site...

📄 DbGate 7.1.8 Remote Code Execution

A proof of concept exploit for a DbGate 7.1.8 unauthenticated remote code execution vulnerability. The exploit abuses the /runners/start endpoint by injecting JavaScript through the JSON script runner's functionName field, allowing arbitrary operating system commands to be executed and their outp...

📄 WordPress Pix for WooCommerce 1.5.0 Shell Upload

This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce plugin for WordPress. Attackers can leverage the missing capability check and insufficient file type validation in the lknpixforwoocommercec6savesettings function to upload arbitrary...

📄 rouille 3.6.2 HTTP Request Smuggling

rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the proxy::proxy and proxy::fullproxy functions. Client-supplied HTTP header values are forwarded to backend servers without validation for control characters, allowing attackers to inject additional HTTP reques...

📄 tiny_http 0.12.0 HTTP Header Injection

tinyhttp versions 0.12.0 and earlier contain an HTTP header injection vulnerability due to improper validation of carriage return and line feed characters in HTTP header values. Applications that reflect or forward attacker-controlled header values can be vulnerable to HTTP response splitting,...

📄 Joomla Content Editor 2.9.99.4 Shell Upload

This Metasploit module exploits an unauthenticated arbitrary profile creation vulnerability in the JCE Joomla Content Editor extension for Joomla!. The profiles.import task fails to enforce authentication, allowing the import of a crafted profile that is directly written to disk as a PHP web shel...

📄 rouille 3.6.2 HTTP Response Splitting

rouille versions 3.6.2 and earlier contain an HTTP response splitting vulnerability due to improper validation of response header values. Applications that place attacker-controlled data into HTTP response headers can inject carriage return and line feed characters, allowing attackers to create...

📄 rouille 3.6.2 HTTP Request Smuggling

rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the reverse proxy implementation. The proxy forwards the client's Transfer-Encoding header unchanged while forwarding a de-chunked request body, allowing backend request desynchronization and, under certain...

📄 TinyWeb 0.0.8 Path Traversal

TinyWeb versions 0.0.8 and earlier contain a path traversal vulnerability in the HTTP request handling logic. An unauthenticated remote attacker can supply ../ sequences within the request path to read arbitrary files outside the configured web root, allowing disclosure of any file accessible to...

📄 TinyWeb 0.0.8 NULL Pointer / Denial of Service

TinyWeb versions 0.0.8 and earlier contain a NULL pointer dereference vulnerability in the HTTP request parsing and response handling logic. An unauthenticated remote attacker can send a malformed HTTP request that causes the server to dereference a NULL Url pointer, crashing worker processes and...

📄 Let's Chat 0.4.8 Information Disclosure

Let's Chat versions 0.4.8 and earlier contain an information disclosure vulnerability in the file download functionality. Any authenticated user can download attachments from private and password-protected rooms without authorization if they know or can derive the associated file identifier...

📄 tiny_http 0.12.0 HTTP Request Smuggling

tinyhttp versions 0.12.0 and earlier contain an HTTP request smuggling vulnerability caused by improper handling of the Transfer-Encoding header. The library checks only for the presence of the header rather than validating its value, allowing inconsistent HTTP request parsing between front-end...

📄 Let's Chat 0.4.8 Denial of Service

Let's Chat versions 0.4.8 and earlier contain a denial of service vulnerability in the message lookup functionality. An authenticated attacker can supply a valid but nonexistent room identifier, triggering an uncaught exception that terminates the Node.js server process. Security Advisory:...

📄 Let's Chat 0.4.8 Missing Authorization

Let's Chat versions 0.4.8 and earlier contain a missing authorization vulnerability in the room archive functionality. Any authenticated user can archive delete arbitrary rooms, including private and password-protected rooms they do not own or have permission to access, resulting in unauthorized...

📄 TinyWeb 0.0.8 Denial of Service

TinyWeb versions 0.0.8 and earlier contain a missing memory deallocation vulnerability that results in unbounded memory consumption. An unauthenticated remote attacker can repeatedly send ordinary HTTP requests to trigger a per-request memory leak, eventually exhausting worker memory and causing ...

📄 Pterodactyl Panel Remote Code Execution

This Metasploit module exploits a vulnerability in Pterodactyl Panel before version 1.11.11 that allows unauthenticated remote code execution through improper handling of locale file operations. The vulnerability exists in the locale.json endpoint which allows path traversal and arbitrary file...

📄 vBulletin 6.2.1 Remote Code Execution

vBulletin version 6.2.1 and prior 6.x versions, along with version 5.7.5 and prior 5.x versions, contain a pre-authentication remote code execution vulnerability in the vB5TemplateRuntime::runMaths method. Insufficient input validation allows a crafted vb:math expression to bypass the regular...

📄 MouseHero 1.2.0+1 Remote Code Execution

MouseHero version 1.2.0+1 contains an unauthenticated remote code execution vulnerability in its remote control protocol. An attacker on the local network can send crafted keyboard and text input events to execute arbitrary commands on a connected Windows system without user interaction. The...

📄 MouseHero 1.2.0+1 Remote Power Control

MouseHero version 1.2.0+1 contains an unauthenticated remote power control vulnerability in its remote control protocol. An attacker on the local network can send crafted control packets to force a target system to sleep, restart, or power off without user interaction. The repository contains a...

📄 SIP Sustainable Irrigation Platform 5.x Cross Site Request Forgery

SIP Sustainable Irrigation Platform version 5.x performs state-changing actions through HTTP GET requests without including any anti-CSRF token or validating the request origin. This can be exploited to perform administrative actions such as disabling the passphrase, rebooting the device, deletin...

📄 SIP Sustainable Irrigation Platform 5.x Cross Site Scripting

SIP Sustainable Irrigation Platform version 5.x stores program names supplied through HTTP requests and later renders them into its web pages without proper output encoding. This can be exploited to execute arbitrary JavaScript in the browser of any user who views the affected pages by creating a...

📄 SIP Sustainable Irrigation Platform 5.x Path Traversal

SIP Sustainable Irrigation Platform version 5.x Backup/Restore functionality suffers from a path traversal vulnerability. The keys in the JSON backup file which have been uploaded are not validated when they are used to generate file paths. An attacker with access to the restore feature can use t...

📄 ThorVG SVG Parser NULL Pointer Dereference

A proof of concept exploit for ThorVG version prior to 1.0.5 demonstrates a NULL pointer dereference vulnerability in the SVG parser. A malformed, truncated child element within a root svg node causes createElement to return a NULL pointer which is subsequently dereferenced by parseStyle without...

📄 WordPress Masteriyo LMS 1.7.1 Privilege Escalation

WordPress Masteriyo LMS learning-management-system plugin version 1.7.1 contains an authenticated Student+ privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit...

📄 WordPress Ads by WPQuads / Quick AdSense Reloaded 2.0.87 Unauthenticated SQL Injection

WordPress Ads by WPQuads / Quick AdSense Reloaded plugin version 2.0.87 contains an unauthenticated SQL injection vulnerability. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable request fl...

📄 WordPress News and Blog Designer Bundle 1.1 LFI / Remote Code Execution

WordPress News and Blog Designer Bundle plugin version 1.1 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Quotes llama 3.1.4 Unauthenticated Blind SQL Injection

WordPress Quotes llama plugin version 3.1.4 contains an unauthenticated time-based blind SQL injection vulnerability through selectsearch. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress YayExtra 1.3.6 Unauthenticated Shell Upload

WordPress YayExtra WooCommerce Extra Product Options plugin version 1.3.6 suffers from an unauthenticated shell upload vulnerability that achieves remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3 Explo...

📄 WordPress Copymatic 1.6 Unauthenticated Shell Upload

WordPress Copymatic plugin version 1.6 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against the...