📄 WordPress Bricks Builder 1.9.6 Remote Code Execution

WordPress Bricks Builder theme versions 1.9.6 and below suffer from a remote code execution vulnerability. Exploit Title: WordPress Bricks Builder Theme - RCE Date: 2026-06-25 Exploit Author: Jared Brits K3ysTr0K3R Vendor Homepage: https://bricksbuilder.io/ Software Link: https://bricksbuilder.io...

📄 PCLink 4.1.1 Insecure Extension Installation

A vulnerable configuration in PCLink version 4.1.1 could potentially be abused to install unauthorized extensions. The script automates the creation of an extension package, hosts it through a local HTTP server, and sends requests to the target application to trigger the extension installation...

📄 Tenable Nessus 10.12.0 SQL Injection

A SQL injection vulnerability exists in Tenable Nessus when importing malicious scan result files .nessus XML. Versions 10.12.0 and below are affected. Exploit Title: Tenable Nessus 10.12.1 - SQL Injection CVE: CVE-2026-57588 Date: 2026-06-26 Exploit Author: Mohammed Idrees Banyamer Author Countr...

📄 PHPSpreadsheet 5.8.0 Remote Code Execution

PHPSpreadsheet version 5.8.0 suffers from a phar deserialization remote code execution vulnerability. ================================================================================================================================== | Title : PHPSpreadsheet 5.8.0 Phar Deserialization RCE | | Auth...

📄 MacOS PackageKit ZSH Environment Privilege Escalation

This Metasploit module exploits CVE-2024-27822, a vulnerability in macOS PackageKit.framework where PKG installer scripts using a ZSH shebang !/bin/zsh are executed as root while inheriting the installing users environment. This causes ZSH to load the users /.zshenv with root privileges before th...

📄 Xerte Online Toolkits 3.15 Unauthenticated Remote Code Execution

Python remote code execution proof of concept exploit for Xerte Online Toolkits targeting multiple vulnerabilities in the elFinder file manager integration. ================================================================================================================================== | Title :...

📄 Strapi CMS 5.36.1 Account Takeover

This Metasploit module exploits a critical bypass vulnerability in Strapi CMS that allows unauthenticated attackers to take over the Super Admin account. ================================================================================================================================== | Title :...

📄 SAP NetWeaver ABAP SAML XML Signature Wrapping Authentication Bypass

This Metasploit module exploits a vulnerability in SAP NetWeaver ABAP's SAML Service Provider implementation CVE-2026-23687. The vulnerability allows an attacker to bypass SAML signature verification through XML Signature wrapping attacks. By crafting a SAML response with a wrapped signature usin...

📄 Strapi Filter Injection Administrator Password Reset

This tool assesses whether filter injection weaknesses can impact administrator account recovery workflows in Strapi deployments. It validates exposure conditions, evaluates enumeration risks, and analyzes password reset flow behavior for defensive security testing. Strapi versions starting in...

📄 Tenda HG7 / HG9 / HG10 Buffer Overflow

This module is a Metasploit auxiliary scanner / denial of service module designed to test a stack-based buffer overflow condition affecting specific Tenda router models through the /boaform/formDOMAINBLK endpoint. The issue is associated with oversized input supplied to the blkDomain parameter,...

📄 Siemens SICAM A8000 25.30 Remote Operation Denial of Service

This is a network stress-testing / denial of service tool written in Python, modeled around a claimed vulnerability CVE-2026-27663 affecting Siemens SICAM A8000 devices...

📄 Tenda HG7 / HG9 / HG10 Buffer Overflow

This Python script is a multi-mode framework targeting an alleged stack-based buffer overflow vulnerability in the /boaform/formDOMAINBLK endpoint of certain Tenda HG-series routers...

📄 SoftmaartCRM 2 Cross Site Request Forgery

SoftmaartCRM version 2 suffers from a cross site request forgery vulnerability. ================================================================================================================================== | Title : SoftmaartCRM v2 CSRF vulnerability | | Author : indoushka | | Tested on :...

📄 Slate Digital Connect 1.37.0 Local Privilege Escalation

Slate Digital Connect version 1.37.0 local proof of concept privilege escalation exploit. ================================================================================================================================== | Title : Slate Digital Connect 1.37.0 Local Privilege Escalation Exploit | ...

📄 Cacti 1.2.30 Remote Code Execution

This Metasploit module is an authenticated remote code execution exploit for Cacti versions 1.2.30 and below. ================================================================================================================================== | Title : Cacti ≤ 1.2.30 Authenticated RCE via Host...

📄 Cockpit CMS 2.13.5 Cross Site Scripting / Account Takeover

Cockpit CMS versions 2.13.5 and below suffer from persistent cross site scripting and cross site request forgery vulnerabilities. CVE-2026-39275 - Stored XSS Leading to Account Takeover in Cockpit CMS Note: Responsibly disclosed to and patched by the Cockpit CMS maintainers prior to publication. ...

📄 ImageMagick 7.x MIFF Decoder Denial of Service

This code generates a malicious MIFF image file designed to exploit a flaw in ImageMagick’s BZip decompression handling. The issue is triggered by a zero-length compressed block, which can cause ImageMagick to enter an infinite loop and consume 100% CPU...

📄 Horde Groupware IMP Webmail Path Traversal / Local File Inclusion

Horde Groupware's IMP Webmail solution contains a path traversal / local file inclusion vulnerability which could be exploited to escalate privileges or bypass authentication. This is patched in version 7.0.1. this is my first time sending to a mailing list so ive chosen something easy. here goes...

📄 Zig 0.16.0 Denial of Service / Integer Overflow

Zig version 0.16.0 suffers from an integer overflow vulnerability that results in a denial of service condition. Agent Spooky’s Fun Parade hereby reports, with the solemnity of a raccoon presenting a subpoena, an integer-overflow panic in Zig’s std.http chunked request-body reader. In Zig 0.16.0...

📄 ImageMagick 7.x MIFF BZip Decoder Infinite Loop Denial of Service

A vulnerability in ImageMagick's MIFF decoder coders/miff.c allows an attacker to cause an infinite loop and CPU exhaustion by providing a specially crafted MIFF file with a compressed block length of zero when BZip compression is enabled...

📄 Samsung Galaxy Zero-Click HFP/A2DP Takeover

Samsung Galaxy buds have an issue where an attacker within Bluetooth range can force a transition of the active audio session to an attacker-controlled device without requiring user interaction. Samsung believes it is a non-issue. MESSAGE HASH SHA-256:...

📄 Zscaler Client Connector macOS Fail-Open SIGSTOP Bypass

Zscaler Client Connector for macOS can be bypassed by a standard local user during the Restart Services / Repair App workflow by suspending user-owned Zscaler processes with SIGSTOP. The reported impact is fail-open loss of ZIA/ZPA enforcement, DLP, telemetry, and tunnel routing while the console...

📄 Whistlelink Site-Access Password Exposed

The Whistlelink reporting portal protects optionally-enabled, password-gated whistleblowing sites with a site-access password. When a visitor unlocks such a site, the client validates the password by issuing an HTTP GET request that carries the password as a URL query-string parameter which is...

📄 Cacti 1.2.30 Remote Code Execution

Cacti versions 1.2.30 and below authenticated remote code execution exploit that uses variable injection via graph rendering. Written in Python. ================================================================================================================================== | Title : Cacti ≤...

📄 Atlassian Central GraphQL Email Enumeration

The loomUnauthenticatedprimaryAuthTypeForEmail GraphQL query on Atlassian's central GraphQL gateway returns different responses depending on whether an email address is registered with Atlassian, allowing unauthenticated user enumeration. CVE-2026-XXXX: Atlassian Central GraphQL — Email Enumerati...

📄 Control Web Panel 0.9.8.1224 SQL Injection

Control Web Panel versions 0.9.8.1224 and below suffer from a remote SQL injection vulnerability via the userRes POST parameter. --------------------------------------------------------------------- Control Web Panel = 0.9.8.1224 userRes SQL Injection Vulnerability...

📄 Flowise CSV Agent Prompt Injection Remote Code Execution

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FlowiseAI Flowise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run method of the CSVAgents class. The issue results from the lack of proper...

📄 ProtonVPN 4.4.1 Unquoted Service Path

ProtonVPN version 4.4.1 suffers from an unquoted service path vulnerability. Exploit Title: ProtonVPN v4.4.1 - Unquoted Service Path Date: 2026-06-22 Exploit Author: Milad Karimi Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Vendor Homepage:...

📄 ICagenda 3.9.14 / 4.0.7 Shell Upload

iCagenda, a popular events and calendar component for Joomla, contains an unauthenticated file upload vulnerability that allows remote attackers to upload and execute arbitrary PHP code on Joomla 6 sites. Versions 3.2.1 through 3.9.14 and 4.0.0 through 4.0.7 are affected.:1 CVE-2026-48939 -...

📄 WordPress WP Full Stripe Free 8.4.3 Missing Authorization

The WP Full Stripe Free plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 8.4.3 via the wpfsupdatefailedpaymentstatus AJAX action. CVE-2026-12432: WP Full Stripe Free = 8.4.4 - Published: June 26, 2026 - Last Updated: June 27, 2026 - Researcher: Netwurm...

📄 Docmost 0.70.2 Authorization Bypass

In Docmost versions 0.70.0 through 0.70.2, restricted child pages hidden from public share viewers could still leak through public share search results. CVE-2026-33146 A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages...

📄 Penpot Server-Side Request Forgery

Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin server-side request forgery because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering. CVE-2026-45806 Penpot's remote...

📄 Peyara Remote Mouse 1.0.1 Unauthenticated Remote Code Execution

This Metasploit module exploits an unauthenticated remote code execution vulnerability in Peyara Remote Mouse 1.0.1. The application exposes a Socket.IO WebSocket service on TCP port 1313 and accepts unauthenticated keyboard input events. The module sends keyboard events to open the Windows comma...

📄 Yeoman Environment 6.0.0 Code Execution

Yeoman Environment versions 2.9.0 through 6.0.0 have an issue where missing generators can be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path. CVE-2026-42089 A local package installation helper trusted caller-supplie...

📄 Docmost Cross Site Scripting

Docmost versions prior to 0.71.0 suffer from a persistent cross site scripting vulnerability. CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I...

📄 Plane Improper Authorization

Plane's asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces. All versions prior to 1.3.1 are affected. CVE-2026-46558 Plane’s V2 asset subsystem trusted...

📄 TypeBot Server-Side Request Forgery

TypeBot versions prior to 3.16.0 suffer from a server-side request forgery vulnerability. CVE-2026-34207 The SSRF filter checked hostname text, but the actual destination was decided later by DNS. That gap let attacker-controlled Webhook URLs reach loopback, metadata, and private network targets...

📄 phpSysInfo 3.4.5 IP Allowlist Bypass

phpSysInfo versions 3.4.5 and below suffer from an IP Allowlist bypass vulnerability. CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then...

📄 Docmost 0.70.x Authorization Bypass

A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace. Versions 0.3.0 through 0.70.x are affected. CVE-2026-34213 A low-privileged Docmost user could supply a victim attachmentId to...

📄 Dalfox Found-Action Deserialization Remote Code Execution

When dalfox versions less than or equal to 2.12.0 is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options - including FoundAction and FoundActionShell - is...

📄 HTTP.sys HTTP/2 Denial of Service

This advisory provides simple proof of concept details to trigger the HTTP/2 denial of service condition related to malformed Accept-Encoding headers. Titles: CVE-2026-49160 - HTTP.sys HTTP/2 Denial of Service DoS Vulnerability Author: nu11secur1ty Date: 06/24/2026 Vendor: Microsoft Corporation...

📄 OpenBSD mpls_do_error Stack Disclosure

OpenBSD suffers from an mplsdoerror remote kernel stack disclosure vulnerability via an MPLS label stack. ------------------------------------------------------------------------ OpenBSD mplsdoerror: Remote Kernel Stack Disclosure via MPLS Label Stack Over-read...

📄 PHP 8.5.7 mb_substr() Underflow

PHP version 8.5.7 suffers an underflow condition that can be exploited to trigger a denial of service condition. PHP 8.5.7 mbsubstr 'SJIS-mac' sizet underflow Author: Khashayar Fereidani Disclosure Date: 2026-06-18 Advisory: https://fereidani.com/php-857-mbsubstr-sjis-mac-sizet-underflow Contact:...

📄 PHP 8.5.7 FILTER_SANITIZE_ENCODED Uninitialized Read

PHP version 8.5.7 suffers from an uninitialized read issue that does not appear immediately useful for any sort of exploitation. PHP 8.5.7 FILTERSANITIZEENCODED uninitialized read Author: Khashayar Fereidani Disclosure Date: 2026-06-18 Advisory:...

📄 Sprecher Automation SPRECON-E-C/-E-P/-E-T3 Missing Secure-Boot / Static Passwords

Sprecher Automation SPRECON-E-C/-E-P/-E-T3 leaks the firmware signing private key, is missing a secure-boot mechanism, has unencrypted flash memory, use of static passwords, and hard-coded vendor accounts. SEC Consult Vulnerability Lab Security Advisory...

📄 PHP 8.5.7 levenshtein() Signed-Integer Overflow

The levenshtein function calculates the Levenshtein distance between two strings, optionally accepting custom costs for insertion, replacement, and deletion operations. In PHP version 8.5.7, the implementation lacks proper bounds checking for these cost parameters. PHP 8.5.7 levenshtein...

📄 PHP 8.5.7 dom_xml_serialization_algorithm() Stack Overflow

PHP version 8.5.7 suffers from a stack overflow vulnerability due to unbounded recursion in domxmlserializationalgorithm and domxmlserializeelementnode. PHP 8.5.7 domxmlserializationalgorithm stack-overflow Author: Khashayar Fereidani Disclosure Date: 2026-06-18 Advisory:...

📄 Worksnaps.net Worksnaps Hardcoded Root Cloud Credentials

Silver Leaf Technologies - Worksnaps.net Worksnaps suffers from a hardcoded credential vulnerability. Several application binaries contained hardcoded credentials, such as AWS access keys and S3 bucket names, which granted access to the production environment. Those hardcoded AWS cloud credential...

📄 OpenBSD sppp_pap_input PAP Authentication Bypass

OpenBSD suffers from a PAP authentication bypass vulnerability via a zero-length bcmp. All versions through 7.6 are affected. ------------------------------------------------------------------------ OpenBSD sppppapinput: PAP Authentication Bypass via Zero-Length bcmp...

📄 N-able Mail Assure Authentication Bypass

N-able Mail Assure appears to suffer from a cross-tenant authentication bypass vulnerability via spoofing. CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure CVE ID: CVE-2025-68624 Status: DISPUTED CWE: CWE-290 Authentication Bypass by Spoofing Affected Product:...