CVE-2019-5420

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.

Github link:
https://github.com/sealldeveloper/CVE-2019-5420-PoC

CVE-2024-32830

None

Github link:
https://github.com/ptrstr/CVE-2024-32830-poc

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.

Github link:
https://github.com/becrevex/CVE-2023-41425

CVE-2016-2098

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Github link:
https://github.com/sealldeveloper/CVE-2016-2098-PoC

CVE-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Github link:
https://github.com/sealldeveloper/CVE-2016-10033-PoC

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.

Github link:
https://github.com/sealldeveloper/CVE-2018-0114-PoC

CVE-2023-1545

None

Github link:
https://github.com/gunzf0x/CVE-2023-1545

CVE-2023-1389

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

Github link:
https://github.com/ibrahimsql/CVE2023-1389

CVE-2024-31317

None

Github link:
https://github.com/agg23/cve-2024-31317

CVE-2024-27808

None

Github link:
https://github.com/Leandrobts/CVE-2024-27808.github.io

CVE-2021-42287

Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291.

Github link:
https://github.com/DanielFEXKEX/CVE-Scanner

CVE-2019-19781

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Github link:
https://github.com/hyunjin0334/CVE-2019-19781

CVE-2015-2797

None

Github link:
https://github.com/Bariskizilkaya/CVE-2015-2797-PoC

CVE-2022-42092

Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.

Github link:
https://github.com/ajdumanhug/CVE-2022-42092

CVE-2017-8386

None

Github link:
https://github.com/suz1n/WHS3_vulhub

CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Github link:
https://github.com/portfolio10/nginx

CVE-2024-27956

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.



Github link:
https://github.com/m4nInTh3mIdDle/wordpress-CVE-2024-27956

CVE-2021-43798

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Github link:
https://github.com/suljov/Grafana-LFI-exploit

CVE-2022-3552

Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.

Github link:
https://github.com/BakalMode/CVE-2022-3552

CVE-2022-29806

None

Github link:
https://github.com/OP3R4T0R/CVE-2022-29806