CVE-2024-4367

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Github link:
https://github.com/pS3ud0RAnD0m/CVE-2024-4367-POC

CVE-2025-30208

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Github link:
https://github.com/TH-SecForge/CVE-2025-30208

CVE-2025-49144

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.

Github link:
https://github.com/b0ySie7e/Notepad-8.8.1_CVE-2025-49144

CVE-2024-54085

None

Github link:
https://github.com/Mr-Zapi/CVE-2024-54085

CVE-2025-6860

None

Github link:
https://github.com/byteReaper77/CVE-2025-6860

CVE-2025-6218

None

Github link:
https://github.com/ignis-sec/CVE-2025-6218

CVE-2022-33679

Windows Kerberos Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-33647.

Github link:
https://github.com/vpxuser/CVE-2022-33679

CVE-2025-5777

None

Github link:
https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-

CVE-2025-6543

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Github link:
https://github.com/seabed-atavism/CVE-2025-6543

CVE-2022-25869

None

Github link:
https://github.com/gkalpak/angularjs-poc-cve-2022-25869

CVE-2024-40898

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue. 

Github link:
https://github.com/ForceEA001/CVE-2024-40898-SSL-Bypass-Detection

CVE-2022-33647

Windows Kerberos Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-33679.

Github link:
https://github.com/vpxuser/CVE-2022-33647

CVE-2025-4664

Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Github link:
https://github.com/amalmurali47/cve-2025-4664

CVE-2017-17761

None

Github link:
https://github.com/mirellesilvajs/iot-vuln-lab-cve-2017-17761

CVE-2024-6345

None

Github link:
https://github.com/nemekath/csrgenerator-secure

CVE-2025-6218

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27198.

Github link:
https://github.com/skimask1690/CVE-2025-6218-POC

CVE-2025-47812

None

Github link:
https://github.com/4m3rr0r/CVE-2025-47812-poc

CVE-2025-32463

None

Github link:
https://github.com/pr0v3rbs/CVE-2025-32463_chwoot

CVE-2021-41773

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Github link:
https://github.com/psibot/apache-vulnerable