CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Github link:
https://github.com/5kr1pt/WriteUp-Roundcube_CVE-2025-49113

CVE-2021-30047

VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.

Github link:
https://github.com/Andreyft7/CVE-2021-30047

CVE-2025-5964

None

Github link:
https://github.com/byteReaper77/CVE-2025-5964-

CVE-2025-4123

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.

The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

Github link:
https://github.com/DesDoTvl/CVE-2025-4123grafana

CVE-2017-0143

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Github link:
https://github.com/Mafiosohack/offensive-security-lab-1

CVE-2025-3248

Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.

Github link:
https://github.com/ynsmroztas/CVE-2025-3248-Langflow-RCE

CVE-2025-0133

None

Github link:
https://github.com/ynsmroztas/-CVE-2025-0133-GlobalProtect-XSS

CVE-2025-48466

None

Github link:
https://github.com/shipcod3/CVE-2025-48466

CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Github link:
https://github.com/B1ack4sh/Blackash-CVE-2025-49113

CVE-2025-6220

None

Github link:
https://github.com/d0n601/CVE-2025-6220

CVE-2021-31956

Windows NTFS Elevation of Privilege Vulnerability

Github link:
https://github.com/deletehead/Pool-Overflow-CVE-2021-31956

CVE-2025-32710

None

Github link:
https://github.com/Sincan2/RCE-CVE-2025-32710

CVE-2025-33053

External control of file name or path in WebDAV allows an unauthorized attacker to execute code over a network.

Github link:
https://github.com/TheTorjanCaptain/CVE-2025-33053-Checker-PoC

CVE-2025-0133

A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN.

There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal.



For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the in

Github link:
https://github.com/wiseep/CVE-2025-0133

CVE-2023-26136

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Github link:
https://github.com/uriyahav/tough-cookie-2.5.0-cve-2023-26136-fix

CVE-2025-26198

None

Github link:
https://github.com/tansique-17/CVE-2025-26198

CVE-2023-6401

None

Github link:
https://github.com/mekitoci/CVE-2023-6401

CVE-2025-33053

External control of file name or path in WebDAV allows an unauthorized attacker to execute code over a network.

Github link:
https://github.com/kra1t0/CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept

CVE-2025-3248

Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.

Github link:
https://github.com/0xgh057r3c0n/CVE-2025-3248

CVE-2025-44203

None

Github link:
https://github.com/IvanT7D3/CVE-2025-44203