CVE-2023-28354

None

Github link:
https://github.com/stormfleet/CVE-2023-28354

CVE-2018-15473

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

Github link:
https://github.com/SUDORM0X/PoC-CVE-2018-15473

CVE-2024-9474

None

Github link:
https://github.com/deathvu/CVE-2024-9474

CVE-2024-48990

None

Github link:
https://github.com/makuga01/CVE-2024-48990-PoC

CVE-2024-10924

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Github link:
https://github.com/julesbsz/CVE-2024-10924

CVE-2024-5084

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Github link:
https://github.com/z1gazaga/CVE-2024-5084

CVE-2024-52317

None

Github link:
https://github.com/TAM-K592/CVE-2024-52317

CVE-2024-10508

None

Github link:
https://github.com/Jenderal92/CVE-2024-10508

CVE-2024-8856

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Github link:
https://github.com/Jenderal92/CVE-2024-8856

CVE-2024-0012

None

Github link:
https://github.com/VegetableLasagne/CVE-2024-0012

CVE-2024-29671

None

Github link:
https://github.com/laskdjlaskdj12/CVE-2024-29671-POC

CVE-2024-10220

None

Github link:
https://github.com/mochizuki875/CVE-2024-10220-githooks

CVE-2024-52318

None

Github link:
https://github.com/TAM-K592/CVE-2024-52318

CVE-2024-52382

None

Github link:
https://github.com/RandomRobbieBF/CVE-2024-52382

CVE-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

Github link:
https://github.com/w0r1i0g1ht/CVE-2024-4439

CVE-2024-45436

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Github link:
https://github.com/XiaomingX/CVE-2024-45436-exp

CVE-2024-48990

None

Github link:
https://github.com/ns989/CVE-2024-48990

CVE-2024-10924

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Github link:
https://github.com/dua1337/Exploit-for-CVE-2024-10924

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Github link:
https://github.com/XiaomingX/cve-2023-38646-poc

CVE-2023-20198

Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system.
For steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory 
Cisco will provide updates on the status of this investigation and when a software patch is available.

Github link:
https://github.com/XiaomingX/CVE-2023-20198-poc