CVE-2019-7214

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

Github link:
https://github.com/ElusiveHacker/CVE-2019-7214

CVE-2023-27163

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

Github link:
https://github.com/J0ey17/Exploit_CVE-2023-27163

CVE-2025-22224

None

Github link:
https://github.com/takeshirisulu/CVE-2025-22224

CVE-2025-49113

None

Github link:
https://github.com/rxerium/CVE-2025-49113

CVE-2025-32206

Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects allows Upload a Web Shell to a Web Server. This issue affects Processing Projects: from n/a through 1.0.2.

Github link:
https://github.com/postal-filled-zap/CVE

CVE-2019-20085

TVT NVMS-1000 devices allow GET /.. Directory Traversal

Github link:
https://github.com/Z3R0-0x30/CVE-2019-20085

CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Github link:
https://github.com/Ademking/CVE-2025-49113-nuclei-template

CVE-2019-12840

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

Github link:
https://github.com/fenix0499/CVE-2019-12840-NodeJs-Exploit

CVE-2023-39910

None

Github link:
https://github.com/z1ph1us/MilkSad-Mnemonic-Generator

CVE-2025-49223

None

Github link:
https://github.com/louay-075/CVE-2025-49223-BillboardJS-PoC

CVE-2025-2539

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read the contents of arbitrary files on the server, which can contain sensitive information.

Github link:
https://github.com/RootHarpy/CVE-2025-2539

CVE-2025-46816

None

Github link:
https://github.com/Guilhem7/CVE-2025-46816

CVE-2025-4123

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

Github link:
https://github.com/ynsmroztas/CVE-2025-4123-Exploit-Tool-Grafana-

CVE-2011-0762

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Github link:
https://github.com/Andreyfts7/CVE-2011-0762

CVE-2022-44268

ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).

Github link:
https://github.com/J0ey17/Automate_Exploit_CVE-2022-44268

CVE-2023-5612

None

Github link:
https://github.com/TopskiyPavelQwertyGang/Review.CVE-2023-5612

CVE-2024-53703

None

Github link:
https://github.com/scrt/cve-2024-53703-poc

CVE-2025-3102

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.

Github link:
https://github.com/B1ack4sh/CVE-2025-3102

CVE-2025-5701

None

Github link:
https://github.com/Nxploited/CVE-2025-5701

CVE-2025-32756

A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.8, FortiNDR versions 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.4, 7.0.0 through 7.0.6, FortiCamera versions 2.1.0 through 2.1.3, 2.0 all versions, 1.1 all versions, allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

Github link:
https://github.com/kn0x0x/CVE-2025-32756-POC