CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Github link:
https://github.com/0xsharz/telerik-scanner-cve-2017-9248

CVE-2025-29632

None

Github link:
https://github.com/OHnogood/CVE-2025-29632

CVE-2024-49138

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Github link:
https://github.com/Humbug52542/DLang-file-encryptor

CVE-2021-22911

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.

Github link:
https://github.com/octodi/CVE-2021-22911

CVE-2025-29927

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Github link:
https://github.com/SugiB3o/vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-46203

None

Github link:
https://github.com/spbavarva/CVE-2025-46203

CVE-2025-48827

None

Github link:
https://github.com/0xgh057r3c0n/CVE-2025-48827

CVE-2025-5328

None

Github link:
https://github.com/voyagken/CVE-2025-5328

CVE-2025-46204

None

Github link:
https://github.com/spbavarva/CVE-2025-46204

CVE-2024-11234

None

Github link:
https://github.com/cyivor/CVE-2024-11234

CVE-2021-26828

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Github link:
https://github.com/ridpath/CVE-2021-26828-Ultimate

CVE-2025-5329

None

Github link:
https://github.com/sahici/CVE-2025-5329

CVE-2025-5319

None

Github link:
https://github.com/sahici/CVE-2025-5319

CVE-2017-0144

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Github link:
https://github.com/pelagornisandersi/WIndows-7-automated-exploitation-using-metasploit-framework-

CVE-2025-47577

None

Github link:
https://github.com/Yucaerin/CVE-2025-47577

CVE-2025-30397

None

Github link:
https://github.com/mbanyamer/CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free-

CVE-2025-4631

None

Github link:
https://github.com/Nxploited/CVE-2025-4631

CVE-2025-5287

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Github link:
https://github.com/wiseep/CVE-2025-5287

CVE-2025-48827

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Github link:
https://github.com/wiseep/CVE-2025-48827

CVE-2025-3248

Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.

Github link:
https://github.com/tiemio/RCE-CVE-2025-3248