CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.

Github link:
https://github.com/SystemVll/CVE-2025-49493

CVE-2025-52488

None

Github link:
https://github.com/SystemVll/CVE-2025-52488

CVE-2025-27415

None

Github link:
https://github.com/jiseoung/CVE-2025-27415-PoC

CVE-2025-29927

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Github link:
https://github.com/mickhacking/thank-u-next

CVE-2023-5360

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

Github link:
https://github.com/X3RX3SSec/CVE-2023-5360

CVE-2025-7340

None

Github link:
https://github.com/Nxploited/CVE-2025-7340

CVE-2025-32463

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Github link:
https://github.com/dbarquero/cve-2025-32463-lab

CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Github link:
https://github.com/dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591

CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Github link:
https://github.com/DarksBlackSk/CVE-2025-27591-Proof-Of-Concept

CVE-2025-5777

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Github link:
https://github.com/SleepNotF0und/CVE-2025-5777

CVE-2025-53833

None

Github link:
https://github.com/B1ack4sh/Blackash-CVE-2025-53833

CVE-2025-25257

None

Github link:
https://github.com/0xgh057r3c0n/CVE-2025-25257

CVE-2025-32463

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Github link:
https://github.com/9Insomnie/CVE-2025-32463

CVE-2025-23167

None

Github link:
https://github.com/abhisek3122/CVE-2025-23167

CVE-2016-0792

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Github link:
https://github.com/gonn4cry/CVE-2016-0792

CVE-2024-4577

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Github link:
https://github.com/Skycritch/CVE-2024-4577

CVE-2023-2640

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.

Github link:
https://github.com/filippo-zullo98/phpMyAdmin-RCE-Exploit-Lab

CVE-2025-32463

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Github link:
https://github.com/MohamedKarrab/CVE-2025-32463

CVE-2025-47812

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

Github link:
https://github.com/rxerium/CVE-2025-47812

CVE-2025-27210

None

Github link:
https://github.com/absholi7ly/CVE-2025-27210_NodeJS_Path_Traversal_Exploit