Team IT Security - ⚠️ PoC

Microsoft Excel LTSC 2024 Remote Code Execution

Sat, 25 Jul 2026 10:05:05 +0200

Topic: Microsoft Excel LTSC 2024 Remote Code Execution Risk: High Text:# Titles: Microsoft Excel LTSC 2024 - Remote Code Execution (RCE) # Author: nu11secur1ty # Date: 06/16/2025 # Vendor: Micros...

Langflow 1.2.x Remote Code Execution (RCE)

Sat, 25 Jul 2026 10:05:03 +0200

Topic: Langflow 1.2.x Remote Code Execution (RCE) Risk: High Text:#!/usr/bin/env python3 # Exploit Title: Langflow 1.2.x - Remote Code Execution (RCE) # Date: 2025-07-11 # Exploit Author: Ra...

Malicious XDG Desktop File

Sat, 25 Jul 2026 10:05:02 +0200

Topic: Malicious XDG Desktop File Risk: Medium Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE

Sat, 25 Jul 2026 10:05:00 +0200

Topic: Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE Risk: High Text:package main import ( "flag" "fmt" "io" "net/http" "net/url" "os" "strings" ) /* Shenzhen Aitemi M300 Wi-...

Pandora ITSM Authenticated Command Injection

Sat, 25 Jul 2026 10:04:59 +0200

Topic: Pandora ITSM Authenticated Command Injection Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Cisco ISE 3.0 Remote Code Execution

Sat, 25 Jul 2026 10:04:57 +0200

Topic: Cisco ISE 3.0 Remote Code Execution Risk: High Text:# Exploit Title: Cisco ISE 3.0 - Remote Code Execution (RCE) # Exploit Author: @ibrahimsql ibrahimsql.com # Exploit Author's ...

JetBrains TeamCity 2023.11.4 Authentication Bypass

Sat, 25 Jul 2026 10:04:56 +0200

Topic: JetBrains TeamCity 2023.11.4 Authentication Bypass Risk: High Text:#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ # Exploit Title: JetBrains TeamCity 2023.11.4 - Authentication Bypass # ...

Projectworlds Online Admission System 1.0 SQL Injection

Sat, 25 Jul 2026 10:04:55 +0200

Topic: Projectworlds Online Admission System 1.0 SQL Injection Risk: Medium Text:/* * Title : projectworlds Online Admission System 1.0 - SQL Injection * Author : Byte Reaper * CVE ...

Tenda AC20 16.03.08.12 Command Injection

Sat, 25 Jul 2026 10:04:53 +0200

Topic: Tenda AC20 16.03.08.12 Command Injection Risk: Medium Text:/* * Exploit Title : Tenda AC20 16.03.08.12 - Command Injection * Author : Byte Reaper * CVE : CVE-2025-90...

DOS Baby POP3 Server 1.04

Sat, 25 Jul 2026 10:04:52 +0200

Topic: DOS Baby POP3 Server 1.04 Risk: Medium Text:# Exploit Title: DOS Baby POP3 Server 1.04 # Date: 12/08/2025 # Exploit Author: Érick Sousa (https://www.linkedin.com/in/eri...

Ghost CMS 5.59.1 Arbitrary File Read

Sat, 25 Jul 2026 10:04:50 +0200

Topic: Ghost CMS 5.59.1 Arbitrary File Read Risk: Medium Text:#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ # Exploit Title: Ghost CMS 5.59.1 - Arbitrary File Read # Date: 2023-09-...

Ultimate Member WordPress Plugin 2.6.6 Privilege Escalation

Sat, 25 Jul 2026 10:04:49 +0200

Topic: Ultimate Member WordPress Plugin 2.6.6 Privilege Escalation Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation # Exploit Author: Gur...

Sitecore XP Post-Authentication File Upload

Sat, 25 Jul 2026 10:04:48 +0200

Topic: Sitecore XP Post-Authentication File Upload Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Commvault CLI Argument Injection / Traversal / Remote Code Execution

Sat, 25 Jul 2026 10:04:46 +0200

Topic: Commvault CLI Argument Injection / Traversal / Remote Code Execution Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Belkin F9K1009 F9K1010 2.00.04/2.00.09 Hard Coded Credentials

Sat, 25 Jul 2026 10:04:45 +0200

Topic: Belkin F9K1009 F9K1010 2.00.04/2.00.09 Hard Coded Credentials Risk: High Text:/* * Title : Belkin F9K1009 F9K1010 2.00.04/2.00.09 - Hard Coded Credentials * Author : Byte Reaper * CVE...

SugarCRM unauthenticated Remote Code Execution (RCE)

Sat, 25 Jul 2026 10:04:43 +0200

Topic: SugarCRM unauthenticated Remote Code Execution (RCE) Risk: High Text:# Exploit Title: SugarCRM unauthenticated Remote Code Execution (RCE) # Exploit Author: DANG # Vendor Homepage: https://www.s...

Vvveb CMS 1.0.5 Remote Code Execution

Sat, 25 Jul 2026 10:04:42 +0200

Topic: Vvveb CMS 1.0.5 Remote Code Execution Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Swagger UI 1.0.3 Cross-Site Scripting (XSS)

Sat, 25 Jul 2026 10:04:41 +0200

Topic: Swagger UI 1.0.3 Cross-Site Scripting (XSS) Risk: Low Text:/* * Author : Byte Reaper * Telegram : @ByteReaper0 * CVE : CVE-2025-8191 * Title : Swagger UI 1.0.3...

Flowise 3.0.4 Remote Code Execution

Sat, 25 Jul 2026 10:04:39 +0200

Topic: Flowise 3.0.4 Remote Code Execution Risk: High Text:# Exploit Title: Flowise 3.0.4 - Remote Code Execution (RCE) # Date: 10/11/2025 # Exploit Author: [nltt0] (https://github.com...

MonstaFTP Unauthenticated File Upload

Sat, 25 Jul 2026 10:04:38 +0200

Topic: MonstaFTP Unauthenticated File Upload Risk: Medium Text:# Titles: MonstaFTP Unauthenticated File Upload CVE-2025-34299 # Author: ibrahimsql # Date: 11/21/2025 # Vendor: https://www...

Mbed TLS 3.6.4 Use-After-Free

Sat, 25 Jul 2026 10:04:36 +0200

Topic: Mbed TLS 3.6.4 Use-After-Free Risk: High Text:/* * Exploit Title: Mbed TLS 3.6.4 - Use-After-Free * Google Dork: N/A * Date: 2025-08-29 * Exploit Author: Byte Reaper...

dotCMS 25.07.02-1 Authenticated Blind SQL Injection

Sat, 25 Jul 2026 10:04:35 +0200

Topic: dotCMS 25.07.02-1 Authenticated Blind SQL Injection Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: dotCMS 25.07.02-1 - Authenticated Blind SQL Injection # Google Dork: N/A # Date: 2...

Birth Chart Compatibility WordPress Plugin 2.0 Full Path Disclosure

Sat, 25 Jul 2026 10:04:33 +0200

Topic: Birth Chart Compatibility WordPress Plugin 2.0 Full Path Disclosure Risk: Low Text:/* * Exploit Title : Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure * Author : Byte Reaper *...

LangChain Core - Serialization Injection to Jinja2 SSTI/RCE

Sat, 25 Jul 2026 10:04:32 +0200

Topic: LangChain Core - Serialization Injection to Jinja2 SSTI/RCE Risk: High Text:# Exploit Title: LangChain Core - Serialization Injection to Jinja2 SSTI/RCE # Date: 2025-12-29 # Exploit Author: Mohammed I...

deephas < = 1.0.7 - Prototype Pollution leading to Arbitrary Code Execution / DoS

Sat, 25 Jul 2026 10:04:31 +0200

Topic: deephas < = 1.0.7 - Prototype Pollution leading to Arbitrary Code Execution / DoS Risk: High Text:#!/usr/bin/env python3 # # Exploit Title: deephas < = 1.0.7 - Prototype Pollution leading to Arbitrary Code Execution / DoS #...

aiohttp 3.9.1 Directory Traversal

Sat, 25 Jul 2026 10:04:29 +0200

Topic: aiohttp 3.9.1 Directory Traversal Risk: Medium Text:# Exploit Title: Python aiohttp directory traversal PoC (CVE-2024-23334) # Google Dork: N/A # Date: 2025-10-06 # Exploit Aut...

Siklu EtherHaul Series EH-8010 Remote Command Execution

Sat, 25 Jul 2026 10:04:28 +0200

Topic: Siklu EtherHaul Series EH-8010 Remote Command Execution Risk: High Text:# Exploit Title:Siklu EtherHaul Series EH-8010 - Remote Command Execution # Shodan Dork: "EH-8010" or "EH-1200" # Date: 2025-...

Google Chrome < 145.0.7632.75 - CSSFontFeatureValuesMap Use-After-Free

Sat, 25 Jul 2026 10:04:26 +0200

Topic: Google Chrome < 145.0.7632.75 - CSSFontFeatureValuesMap Use-After-Free Risk: High Text:# Exploit Title: Google Chrome < 145.0.7632.75 - CSSFontFeatureValuesMap Use-After-Free # Date: 2026-02-23 # Exploit Author: ...

OpenClaw tools.exec.safeBins < = 2026.2.22 Remote Code Execution

Sat, 25 Jul 2026 10:04:25 +0200

Topic: OpenClaw tools.exec.safeBins < = 2026.2.22 Remote Code Execution Risk: Low Text:#!/usr/bin/env python3 # Exploit Title: OpenClaw tools.exec.safeBins < = 2026.2.22 Remote Code Execution # CVE: CV...

Kanboard < = 1.2.50 Authenticated SQL Injection

Sat, 25 Jul 2026 10:04:24 +0200

Topic: Kanboard < = 1.2.50 Authenticated SQL Injection Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Kanboard Authenticated SQL Injection in ProjectPermissionController # CVE: ...

OpenClaw < 2026.3.28 Discord Text Approval Authorization Bypass

Sat, 25 Jul 2026 10:04:22 +0200

Topic: OpenClaw < 2026.3.28 Discord Text Approval Authorization Bypass Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: OpenClaw Discord Text Approval Authorization Bypass # CVE: CVE-2026-41303 # Date: 20...

Green Hills INTEGRITY RTOS IPCOMShell TELNET Format String Vulnerability - Realistic Full Chain Attack on F-16 Avionics (Ground

Sat, 25 Jul 2026 10:04:21 +0200

Topic: Green Hills INTEGRITY RTOS IPCOMShell TELNET Format String Vulnerability - Realistic Full Chain Attack on F-16 Avionics (Ground Risk: Low Text:#!/usr/bin/env python3 # Exploit Title: Green Hills INTEGRITY RTOS IPCOMShell TELNET Format String Full Chain - Realistic F-16...

NiceGUI 3.6.1 Path Traversal

Sat, 25 Jul 2026 10:04:20 +0200

Topic: NiceGUI 3.6.1 Path Traversal Risk: Medium Text:# Exploit Title: NiceGUI 3.6.1 - Path Traversal # Author: Mohammed Idrees Banyamer # Instagram: @banyamer_security # GitHub...

Apache HTTP Server 2.4.66 mod_http2 Double-Free Denial of Service

Sat, 25 Jul 2026 10:04:17 +0200

Topic: Apache HTTP Server 2.4.66 mod_http2 Double-Free Denial of Service Risk: Medium Text:# Exploit Title: Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service # Google Dork: intext:"Apache/2.4.66" "...

ePati Antikor NGFW 2.0.1301 Authentication Bypass

Sat, 25 Jul 2026 10:04:16 +0200

Topic: ePati Antikor NGFW 2.0.1301 Authentication Bypass Risk: Medium Text:# Exploit Title: ePati Antikor NGFW 2.0.1301 - Authentication Bypass # Date: 2026-04-13 # Exploit Author: [SADIK ERTÜRK] ...

XenForo XSS CVE Scanner — Passive Detection Tool for CVE-2026-35055, CVE-2026-35054, CVE-2026-35057

Sat, 25 Jul 2026 10:04:12 +0200

Topic: XenForo XSS CVE Scanner — Passive Detection Tool for CVE-2026-35055, CVE-2026-35054, CVE-2026-35057 Risk: Low Text:#!/usr/bin/env python3 """ XenForo XSS CVE Scanner Author: Xasthur Passive detection for CVE-2026-35055, CVE-2026-35054, ...

PraisonAI CodeAgent < = 1.6.77 Remote Code Execution (RCE) via Unsandboxed LLM Code Execution

Sat, 25 Jul 2026 10:04:08 +0200

Topic: PraisonAI CodeAgent < = 1.6.77 Remote Code Execution (RCE) via Unsandboxed LLM Code Execution Risk: High Text:#!/usr/bin/env python3 # Exploit Title: PraisonAI CodeAgent < = 1.6.77 Remote Code Execution (RCE) via Unsandboxed LLM ...

Microsoft Edge < = 150.0.4078.48 (Chromium-based) Type Confusion RCE

Sat, 25 Jul 2026 10:04:07 +0200

Topic: Microsoft Edge < = 150.0.4078.48 (Chromium-based) Type Confusion RCE Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Microsoft Edge < = 150.0.4078.48 (Chromium-based) Type Confusion RCE # CVE: ...

Joomla Page Builder CK < = 3.5.10 - Unauthenticated Arbitrary File Upload (RCE)

Sun, 19 Jul 2026 11:36:24 +0200

Topic: Joomla Page Builder CK < = 3.5.10 - Unauthenticated Arbitrary File Upload (RCE) Risk: High Text:#!/usr/bin/env python3 # Exploit Title: Joomla Page Builder CK < = 3.5.10 - Unauthenticated Arbitrary File Upload (RCE) # Goog...

[webapps] Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure

Wed, 08 Jul 2026 15:54:08 +0200

Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure

[webapps] Krayin CRM v2.2.x - Authenticated Remote Code Execution

Wed, 08 Jul 2026 15:54:07 +0200

Krayin CRM v2.2.x - Authenticated Remote Code Execution

[webapps] Langflow 1.9.0 - RCE

Wed, 08 Jul 2026 15:36:47 +0200

Langflow 1.9.0 - RCE

[webapps] Joomla Page Builder CK 3.5.10 - Arbitrary File Upload

Wed, 08 Jul 2026 15:36:46 +0200

Joomla Page Builder CK 3.5.10 - Arbitrary File Upload

[webapps] MCPJam Inspector - Remote Code Execution

Tue, 07 Jul 2026 16:39:54 +0200

MCPJam Inspector - Remote Code Execution

[local] ProtonVPN v4.4.1 - Unquoted Service Path

Tue, 07 Jul 2026 16:11:21 +0200

ProtonVPN v4.4.1 - Unquoted Service Path

[webapps] Flowise 3.1.3 - arbitrary code execution

Tue, 07 Jul 2026 15:52:40 +0200

Flowise 3.1.3 - arbitrary code execution

[webapps] Discuz! X5.0 - Authentication Bypass

Tue, 07 Jul 2026 15:38:50 +0200

Discuz! X5.0 - Authentication Bypass

[webapps] WordPress Bricks Builder Theme - RCE

Tue, 07 Jul 2026 15:38:48 +0200

WordPress Bricks Builder Theme - RCE

[webapps] Tenable Nessus 10.12.1 - SQL Injection

Tue, 07 Jul 2026 15:38:47 +0200

Tenable Nessus 10.12.1 - SQL Injection

[remote] iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter

Tue, 07 Jul 2026 15:38:46 +0200

iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter

[remote] Hydra - Stack Buffer Overflow

Tue, 07 Jul 2026 15:38:45 +0200

Hydra - Stack Buffer Overflow

[webapps] KeepInMind 0.8.4.2 - Stored XSS

Mon, 06 Jul 2026 15:40:50 +0200

KeepInMind 0.8.4.2 - Stored XSS

[local] MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation

Mon, 06 Jul 2026 15:40:49 +0200

MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation

[webapps] Joomla Extension 4.1.4 - PHP Object injection

Mon, 06 Jul 2026 15:40:48 +0200

Joomla Extension 4.1.4 - PHP Object injection

[webapps] Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass

Mon, 06 Jul 2026 15:40:47 +0200

Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass

[webapps] WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)

Mon, 06 Jul 2026 15:21:28 +0200

WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)

[webapps] KNX visualisering - Broken Access Control

Mon, 06 Jul 2026 15:21:27 +0200

KNX visualisering - Broken Access Control

[local] Windows Defender (MsMpEng.exe) - Race Condition

Mon, 06 Jul 2026 15:21:25 +0200

Windows Defender (MsMpEng.exe) - Race Condition

[webapps] OpenEMR 7.0.2 - Arbitrary File Read

Mon, 08 Jun 2026 15:53:41 +0200

OpenEMR 7.0.2 - Arbitrary File Read

[webapps] WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection

Fri, 05 Jun 2026 13:21:16 +0200

WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection

[webapps] WordPress OrderConvo 14 - Path Traversal

Mon, 01 Jun 2026 19:52:20 +0200

WordPress OrderConvo 14 - Path Traversal

[webapps] Drupal Core 10.5.5 - Error-Based SQL Injection

Mon, 01 Jun 2026 19:52:18 +0200

Drupal Core 10.5.5 - Error-Based SQL Injection

[webapps] YAMCS yamcs-core 5.12.7 - No Rate Limiting

Sat, 30 May 2026 15:39:01 +0200

YAMCS yamcs-core 5.12.7 - No Rate Limiting

[webapps] YAMCS yamcs-core 5.12.7 - User Enumeration

Sat, 30 May 2026 15:39:00 +0200

YAMCS yamcs-core 5.12.7 - User Enumeration

[remote] Notepad++ 8.9.6 - Arbitrary Code Execution

Sat, 30 May 2026 15:38:58 +0200

Notepad++ 8.9.6 - Arbitrary Code Execution

[webapps] YAMCS yamcs-core 5.12.7 - LDAP Injection

Sat, 30 May 2026 15:23:23 +0200

YAMCS yamcs-core 5.12.7 - LDAP Injection

[remote] Microsoft - NTLMv2 Hash Capture

Fri, 29 May 2026 10:38:16 +0200

Microsoft - NTLMv2 Hash Capture

[webapps] MikroORM 7.0.13 - SQL Injection

Fri, 29 May 2026 10:38:15 +0200

MikroORM 7.0.13 - SQL Injection

[local] ZTE H298A / H108N - Unauthenticated Credential Exposure

Fri, 29 May 2026 10:22:07 +0200

ZTE H298A / H108N - Unauthenticated Credential Exposure

[local] ZTE ZXHN H188A V6 - Authentication Bypass

Fri, 29 May 2026 10:22:06 +0200

ZTE ZXHN H188A V6 - Authentication Bypass

[local] ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion

Fri, 29 May 2026 10:22:05 +0200

ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion

[local] ZTE Routers - Unauthenticated Denial of Service

Fri, 29 May 2026 10:22:04 +0200

ZTE Routers - Unauthenticated Denial of Service

[webapps] Langflow 1.3.0 - Remote Code Execution

Fri, 29 May 2026 10:22:03 +0200

Langflow 1.3.0 - Remote Code Execution

[webapps] Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution

Fri, 29 May 2026 10:22:01 +0200

Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution

[webapps] Prodigy Commerce 3.3.0 - Local File Inclusion

Fri, 29 May 2026 10:22:00 +0200

Prodigy Commerce 3.3.0 - Local File Inclusion

[webapps] MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution

Fri, 29 May 2026 09:54:52 +0200

MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution

[local] Linux Kernel - Local Privilege Escalation

Fri, 29 May 2026 09:54:51 +0200

Linux Kernel - Local Privilege Escalation

[webapps] CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

Fri, 29 May 2026 08:35:49 +0200

CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

[remote] Wing FTP Server 8.1.3 - Authenticated Remote Code Execution

Fri, 29 May 2026 08:35:48 +0200

Wing FTP Server 8.1.3 - Authenticated Remote Code Execution

[dos] strongSwan 5.9.13 - DoS

Fri, 29 May 2026 08:23:20 +0200

strongSwan 5.9.13 - DoS

[remote] strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow

Fri, 29 May 2026 08:23:19 +0200

strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow

[local] Linux Kernel - Local Privilege Escalation

Wed, 27 May 2026 15:27:14 +0200

Linux Kernel - Local Privilege Escalation

[webapps] EspoCRM 9.3.3 - SSRF

Wed, 27 May 2026 15:27:12 +0200

EspoCRM 9.3.3 - SSRF

[webapps] Casdoor 3.54.1 - Arbitrary File Write via Path Traversal

Wed, 27 May 2026 15:27:10 +0200

Casdoor 3.54.1 - Arbitrary File Write via Path Traversal

[webapps] scramble - Remote Code Execution

Wed, 27 May 2026 15:09:36 +0200

scramble - Remote Code Execution

[local] Realtek rtl819x - Local Privilege

Wed, 27 May 2026 14:55:18 +0200

Realtek rtl819x - Local Privilege

[webapps] OpenCATS 0.9.7.4 - SQL Injection

Wed, 27 May 2026 14:55:17 +0200

OpenCATS 0.9.7.4 - SQL Injection

[hardware] MeiG Smart FORGE_SLT711 - OS Command Injection

Wed, 27 May 2026 14:55:16 +0200

MeiG Smart FORGE_SLT711 - OS Command Injection

[webapps] Grav CMS 2.0.0-beta.2 - Remote Code Execution

Tue, 26 May 2026 17:26:55 +0200

Grav CMS 2.0.0-beta.2 - Remote Code Execution

[webapps] cPanel - CRLF Injection

Tue, 26 May 2026 17:10:30 +0200

cPanel - CRLF Injection

[webapps] Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover

Tue, 26 May 2026 17:10:28 +0200

Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover

[hardware] D-Link DSL2600U - 'rom-0' Admin Password Disclosure

Tue, 26 May 2026 17:10:26 +0200

D-Link DSL2600U - 'rom-0' Admin Password Disclosure

[webapps] Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service

Tue, 26 May 2026 17:10:25 +0200

Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service

[local] Linux Kernel 6.8 - Local Privilege Escalation

Tue, 26 May 2026 16:56:24 +0200

Linux Kernel 6.8 - Local Privilege Escalation

[webapps] BookStack 25.12.1 - Denial of Service

Thu, 21 May 2026 15:40:57 +0200

BookStack 25.12.1 - Denial of Service

[webapps] FUXA 1.2.9 - RCE

Thu, 21 May 2026 15:40:55 +0200

FUXA 1.2.9 - RCE

[webapps] solaredge - (CSRF-OOB-Injection)

Thu, 21 May 2026 15:40:53 +0200

solaredge - (CSRF-OOB-Injection)

[webapps] Cockpit 359 - RCE

Thu, 21 May 2026 15:40:51 +0200

Cockpit 359 - RCE

[local] Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path

Thu, 21 May 2026 15:40:48 +0200

Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path

[local] Windows Snipping Tool - NTLMv2 Hash Hijack

Fri, 15 May 2026 16:54:14 +0200

Windows Snipping Tool - NTLMv2 Hash Hijack

[local] Remote Sunrise Helper for Windows 2026.14 - Unauthenticated File/Directory Listing

Fri, 15 May 2026 14:55:37 +0200

Remote Sunrise Helper for Windows 2026.14 - Unauthenticated File/Directory Listing

[local] Remote Sunrise Helper for Windows 2026.14 - Remote Code Execution

Fri, 15 May 2026 14:55:35 +0200

Remote Sunrise Helper for Windows 2026.14 - Remote Code Execution

[webapps] WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI

Thu, 14 May 2026 16:39:46 +0200

WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI

[webapps] ePati Antikor NGFW 2.0.1301 - Authentication Bypass

Thu, 14 May 2026 15:12:27 +0200

ePati Antikor NGFW 2.0.1301 - Authentication Bypass

[webapps] PJPROJECT 2.16 - Heap Bufferoverflow

Thu, 14 May 2026 15:12:25 +0200

PJPROJECT 2.16 - Heap Bufferoverflow

[webapps] Apache HertzBeat 1.8.0 - Remote Code Execution

Thu, 14 May 2026 15:12:22 +0200

Apache HertzBeat 1.8.0 - Remote Code Execution

[webapps] glances 4.5.2 - command injection

Wed, 13 May 2026 15:25:55 +0200

glances 4.5.2 - command injection

[webapps] Ninja Forms Uploads - Unauthenticated PHP File Upload

Wed, 13 May 2026 15:25:53 +0200

Ninja Forms Uploads - Unauthenticated PHP File Upload

[webapps] Flowise < 3.0.5 - Missing Authentication for Critical Function

Wed, 13 May 2026 15:07:27 +0200

Flowise < 3.0.5 - Missing Authentication for Critical Function

[webapps] coreruleset 4.21.0 - Firewall Bypass

Wed, 13 May 2026 15:07:25 +0200

coreruleset 4.21.0 - Firewall Bypass

[remote] telnetd 2.7 - Buffer Overflow

Thu, 07 May 2026 16:42:01 +0200

telnetd 2.7 - Buffer Overflow

[webapps] Bludit CMS 3.18.4 - RCE

Thu, 07 May 2026 16:25:32 +0200

Bludit CMS 3.18.4 - RCE

[webapps] LuaJIT 2.1.1774638290 - Arbitrary Code Execution

Thu, 07 May 2026 16:25:31 +0200

LuaJIT 2.1.1774638290 - Arbitrary Code Execution

[webapps] Ghost CMS 6.19.0 - SQLi

Thu, 07 May 2026 16:25:28 +0200

Ghost CMS 6.19.0 - SQLi

[local] NocoBase 2.0.27 - VM Sandbox Escape

Thu, 07 May 2026 16:11:12 +0200

NocoBase 2.0.27 - VM Sandbox Escape

[webapps] ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)

Thu, 07 May 2026 16:11:11 +0200

ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)

[local] Linux nf_tables 6.19.3 - Local Privilege Escalation

Mon, 04 May 2026 16:10:16 +0200

Linux nf_tables 6.19.3 - Local Privilege Escalation

[local] Linux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation

Mon, 04 May 2026 16:10:14 +0200

Linux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation

[hardware] Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE)

Mon, 04 May 2026 15:54:19 +0200

Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE)

[webapps] Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)

Mon, 04 May 2026 15:40:50 +0200

Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)

[local] Windows 11 24H2 - Local Privilege Escalation

Mon, 04 May 2026 15:40:48 +0200

Windows 11 24H2 - Local Privilege Escalation

[webapps] MindsDB 25.9.1.1 - Path Traversal

Mon, 04 May 2026 15:40:47 +0200

MindsDB 25.9.1.1 - Path Traversal

[webapps] FUXA 1.2.8 - Authentication Bypass + RCE Exploit

Thu, 30 Apr 2026 12:38:57 +0200

FUXA 1.2.8 - Authentication Bypass + RCE Exploit

[webapps] Python-Multipart 0.0.22 - Path Traversal

Thu, 30 Apr 2026 12:08:39 +0200

Python-Multipart 0.0.22 - Path Traversal

[local] Windows 11 23H2 - Denial of Service (DoS)

Thu, 30 Apr 2026 11:51:20 +0200

Windows 11 23H2 - Denial of Service (DoS)

[local] Google Chrome 145.0.7632.75 - CSSFontFeatureValuesMap

Thu, 30 Apr 2026 11:51:19 +0200

Google Chrome 145.0.7632.75 - CSSFontFeatureValuesMap

[webapps] Repetier-Server 1.4.10 - Path Traversal

Thu, 30 Apr 2026 11:51:18 +0200

Repetier-Server 1.4.10 - Path Traversal

[webapps] HUSTOJ Zip-Slip v26.01.24 - RCE

Thu, 30 Apr 2026 11:51:16 +0200

HUSTOJ Zip-Slip v26.01.24 - RCE

[local] Windows 11 25H2 - Heap Overflow

Thu, 30 Apr 2026 10:53:18 +0200

Windows 11 25H2 - Heap Overflow

[webapps] BusyBox 1.37.0 - Path Traversal

Thu, 30 Apr 2026 10:53:17 +0200

BusyBox 1.37.0 - Path Traversal

[webapps] JUNG Smart Visu Server 1.1.1050 - Dos

Thu, 30 Apr 2026 10:53:15 +0200

JUNG Smart Visu Server 1.1.1050 - Dos

[webapps] SumatraPDF 3.5.2 - Remote Code Execution

Thu, 30 Apr 2026 10:23:08 +0200

SumatraPDF 3.5.2 - Remote Code Execution

[webapps] Frigate NVR 0.16.3 - Remote Code Execution

Thu, 30 Apr 2026 10:23:06 +0200

Frigate NVR 0.16.3 - Remote Code Execution

[webapps] NiceGUI 3.6.1 - Path Traversal

Thu, 30 Apr 2026 10:23:04 +0200

NiceGUI 3.6.1 - Path Traversal

[webapps] Js2Py 0.74 - RCE

Thu, 30 Apr 2026 10:07:18 +0200

Js2Py 0.74 - RCE

[webapps] Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection

Thu, 30 Apr 2026 09:36:19 +0200

Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection

[webapps] Camaleon CMS v2.9.0 - Path Traversal

Thu, 30 Apr 2026 09:36:18 +0200

Camaleon CMS v2.9.0 - Path Traversal

[webapps] SUSE Manager 4.3.15 - Code Execution

Thu, 30 Apr 2026 09:23:04 +0200

SUSE Manager 4.3.15 - Code Execution

[webapps] Erugo 0.2.14 - Remote Code Execution (RCE)

Thu, 30 Apr 2026 09:23:02 +0200

Erugo 0.2.14 - Remote Code Execution (RCE)

[webapps] deephas 1.0.7 - Prototype Pollution

Thu, 30 Apr 2026 09:23:01 +0200

deephas 1.0.7 - Prototype Pollution

[webapps] Craft CMS 5.6.16 - RCE

Wed, 29 Apr 2026 13:22:28 +0200

Craft CMS 5.6.16 - RCE

[local] GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation

Wed, 29 Apr 2026 13:22:26 +0200

GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation

[webapps] HAX CMS 24.x - Stored Cross-Site Scripting (XSS)

Wed, 29 Apr 2026 13:22:24 +0200

HAX CMS 24.x - Stored Cross-Site Scripting (XSS)

[webapps] GeographicLib v2.5.1 - stack buffer overflow

Wed, 29 Apr 2026 12:36:23 +0200

GeographicLib v2.5.1 - stack buffer overflow

[webapps] phpMyFAQ 4.0.16 - Improper Authorization

Wed, 29 Apr 2026 12:36:21 +0200

phpMyFAQ 4.0.16 - Improper Authorization

[local] OpenWrt 23.05 - Authenticated Remote Code Execution (RCE)

Wed, 29 Apr 2026 09:35:46 +0200

OpenWrt 23.05 - Authenticated Remote Code Execution (RCE)

[webapps] OpenKM 6.3.12 - Multiple

Wed, 29 Apr 2026 09:35:44 +0200

OpenKM 6.3.12 - Multiple

[webapps] FacturaScripts 2025.43 - XSS

Wed, 29 Apr 2026 09:23:02 +0200

FacturaScripts 2025.43 - XSS

[webapps] GUnet OpenEclass E-learning platform < 4.2 - Remote Code Execution (RCE)

Wed, 29 Apr 2026 09:23:01 +0200

GUnet OpenEclass E-learning platform < 4.2 - Remote Code Execution (RCE)

[webapps] JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution

Wed, 29 Apr 2026 09:23:00 +0200

JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution

[webapps] Xibo CMS 4.3.0 - RCE via SSTI

Wed, 29 Apr 2026 07:52:18 +0200

Xibo CMS 4.3.0 - RCE via SSTI

[local] Atlona ATOMERX21 - Authenticated Command Injection

Wed, 29 Apr 2026 07:36:02 +0200

Atlona ATOMERX21 - Authenticated Command Injection

[webapps] LangChain Core 1.2.4 - SSTI/RCE

Wed, 29 Apr 2026 07:36:01 +0200

LangChain Core 1.2.4 - SSTI/RCE

[local] Fedora - Local Privilege Escalation

Wed, 29 Apr 2026 07:36:00 +0200

Fedora - Local Privilege Escalation

[local] AVAST Antivirus 25.11 - Unquoted Service Path

Wed, 22 Apr 2026 15:05:25 +0200

AVAST Antivirus 25.11 - Unquoted Service Path

[webapps] WordPress Plugin 5.2.0 - Broken Access Control

Wed, 22 Apr 2026 15:05:21 +0200

WordPress Plugin 5.2.0 - Broken Access Control

[local] Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation

Wed, 22 Apr 2026 15:05:17 +0200

Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation

[local] NetBT e-Fatura - Privilege Escalation

Fri, 10 Apr 2026 16:11:06 +0200

NetBT e-Fatura - Privilege Escalation

[webapps] D-Link DIR-650IN - Authenticated Command Injection

Fri, 10 Apr 2026 16:11:05 +0200

D-Link DIR-650IN - Authenticated Command Injection

[webapps] RomM 4.4.0 - XSS_CSRF Chain

Thu, 09 Apr 2026 19:53:30 +0200

RomM 4.4.0 - XSS_CSRF Chain

[webapps] React Server 19.2.0 - Remote Code Execution

Thu, 09 Apr 2026 19:53:29 +0200

React Server 19.2.0 - Remote Code Execution

[webapps] Jumbo Website Manager - Remote Code Execution

Thu, 09 Apr 2026 19:37:02 +0200

Jumbo Website Manager - Remote Code Execution

[local] ZSH 5.9 - RCE

Thu, 09 Apr 2026 19:37:00 +0200

ZSH 5.9 - RCE

[webapps] xibocms 3.3.4 - RCE

Wed, 08 Apr 2026 17:22:15 +0200

xibocms 3.3.4 - RCE

[local] 7-Zip 24.00 - Directory Traversal

Wed, 08 Apr 2026 17:22:14 +0200

7-Zip 24.00 - Directory Traversal

[webapps] FortiWeb 8.0.2 - Remote Code Execution

Wed, 08 Apr 2026 17:22:12 +0200

FortiWeb 8.0.2 - Remote Code Execution

[webapps] Horilla v1.3 - RCE

Wed, 08 Apr 2026 16:38:38 +0200

Horilla v1.3 - RCE

[local] Microsoft MMC MSC EvilTwin - Local Admin Creation

Wed, 08 Apr 2026 16:38:37 +0200

Microsoft MMC MSC EvilTwin - Local Admin Creation

[local] SQLite 3.50.1 - Heap Overflow

Wed, 08 Apr 2026 16:38:35 +0200

SQLite 3.50.1 - Heap Overflow

[webapps] Fortinet FortiWeb v8.0.1 - Auth Bypass

Mon, 06 Apr 2026 15:22:41 +0200

Fortinet FortiWeb v8.0.1 - Auth Bypass

[local] Windows Kernel - Elevation of Privilege

Mon, 06 Apr 2026 15:22:39 +0200

Windows Kernel - Elevation of Privilege

[local] is-localhost-ip 2.0.0 - SSRF

Mon, 06 Apr 2026 15:22:37 +0200

is-localhost-ip 2.0.0 - SSRF

[webapps] ASP.net 8.0.10 - Bypass

Mon, 06 Apr 2026 15:09:37 +0200

ASP.net 8.0.10 - Bypass

[local] Desktop Window Manager Core Library 10.0.10240.0 - Privilege Escalation

Mon, 06 Apr 2026 15:09:36 +0200

Desktop Window Manager Core Library 10.0.10240.0 - Privilege Escalation

[webapps] WordPress Madara - Local File Inclusion

Mon, 06 Apr 2026 14:55:57 +0200

WordPress Madara - Local File Inclusion

[webapps] WBCE CMS 1.6.4 - Remote Code Execution

Mon, 06 Apr 2026 14:55:55 +0200

WBCE CMS 1.6.4 - Remote Code Execution

[webapps] RiteCMS 3.1.0 - Authenticated Remote Code Execution

Mon, 06 Apr 2026 14:55:54 +0200

RiteCMS 3.1.0 - Authenticated Remote Code Execution

[webapps] Zhiyuan OA - arbitrary file upload leading

Mon, 06 Apr 2026 14:55:52 +0200

Zhiyuan OA - arbitrary file upload leading

[webapps] Grafana 11.6.0 - SSRF

Mon, 06 Apr 2026 14:55:51 +0200

Grafana 11.6.0 - SSRF

[webapps] mailcow 2025-01a - Host Header Password Reset Poisoning

Tue, 03 Mar 2026 12:24:56 +0100

mailcow 2025-01a - Host Header Password Reset Poisoning

[webapps] WordPress Backup Migration 1.3.7 - Remote Command Execution

Tue, 03 Mar 2026 12:24:54 +0100

WordPress Backup Migration 1.3.7 - Remote Command Execution

[webapps] Easy File Sharing Web Server v7.2 - Buffer Overflow

Tue, 03 Mar 2026 12:08:51 +0100

Easy File Sharing Web Server v7.2 - Buffer Overflow

[webapps] WeGIA 3.5.0 - SQL Injection

Tue, 03 Mar 2026 11:08:45 +0100

WeGIA 3.5.0 - SQL Injection

[webapps] Boss Mini v1.4.0 - Local File Inclusion (LFI)

Tue, 03 Mar 2026 11:08:43 +0100

Boss Mini v1.4.0 - Local File Inclusion (LFI)

[webapps] motionEye 0.43.1b4 - RCE

Wed, 11 Feb 2026 11:23:29 +0100

motionEye 0.43.1b4 - RCE

[local] glibc 2.38 - Buffer Overflow

Wed, 11 Feb 2026 11:09:11 +0100

glibc 2.38 - Buffer Overflow

[remote] Windows 10.0.17763.7009 - spoofing vulnerability

Wed, 11 Feb 2026 11:09:09 +0100

Windows 10.0.17763.7009 - spoofing vulnerability

[remote] windows 10/11 - NTLM Hash Disclosure Spoofing

Wed, 04 Feb 2026 14:52:15 +0100

windows 10/11 - NTLM Hash Disclosure Spoofing

[remote] Redis 8.0.2 - RCE

Wed, 04 Feb 2026 14:52:13 +0100

Redis 8.0.2 - RCE

[webapps] OctoPrint 1.11.2 - File Upload

Wed, 04 Feb 2026 14:34:41 +0100

OctoPrint 1.11.2 - File Upload

[webapps] FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution

Wed, 04 Feb 2026 14:21:33 +0100

FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution

[local] Docker Desktop 4.44.3 - Unauthenticated API Exposure

Wed, 04 Feb 2026 14:21:32 +0100

Docker Desktop 4.44.3 - Unauthenticated API Exposure

[webapps] aiohttp 3.9.1 - directory traversal PoC

Wed, 04 Feb 2026 14:21:30 +0100

aiohttp 3.9.1 - directory traversal PoC

[remote] Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

Wed, 04 Feb 2026 14:21:29 +0100

Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

[hardware] D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)

Mon, 02 Feb 2026 10:11:35 +0100

D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)

[webapps] RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)

Mon, 02 Feb 2026 10:11:34 +0100

RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)

[webapps] Piranha CMS 12.0 - Stored XSS in Text Block

Mon, 02 Feb 2026 10:11:32 +0100

Piranha CMS 12.0 - Stored XSS in Text Block

AVideo Notify.ffmpeg.json.php Unauthenticated Remote Code Execution

Sun, 18 Jan 2026 22:49:25 +0100

Topic: AVideo Notify.ffmpeg.json.php Unauthenticated Remote Code Execution Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

[webapps] RPi-Jukebox-RFID 2.8.0 - Remote Command Execution

Sat, 17 Jan 2026 15:06:21 +0100

RPi-Jukebox-RFID 2.8.0 - Remote Command Execution

[webapps] Siklu EtherHaul Series EH-8010 - Remote Command Execution

Sat, 17 Jan 2026 14:50:32 +0100

Siklu EtherHaul Series EH-8010 - Remote Command Execution