diff --git a/2011/CVE-2011-2523.md b/2011/CVE-2011-2523.md index e771300fc5..bab00d85ab 100644 --- a/2011/CVE-2011-2523.md +++ b/2011/CVE-2011-2523.md @@ -112,6 +112,7 @@ vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which - https://github.com/ParmeshwarSao/Project-EH - https://github.com/Patrick122333/4240project - https://github.com/Paulineclv/Port-Scanner +- https://github.com/Prabashana20/Penetration-Testing-Kali-vs-Metasploitable - https://github.com/Prachi-Sharma-git/Exploit_FTP - https://github.com/Prakanth20/Network-Scanner-with-Banner-Grabbing-and-CVE-Detection - https://github.com/Pritt014/metasploitable2-pentest @@ -175,6 +176,7 @@ vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which - https://github.com/coolsikandarakr/CEH-Training-Project - https://github.com/cowsecurity/CVE-2011-2523 - https://github.com/csk/unisecbarber +- https://github.com/cybermads/CVE-2011-2523 - https://github.com/deboogo/metasploitable-analysis - https://github.com/deepdarkworld/EXPLOIT_CVE - https://github.com/delsawright/Hotel-Dorsey-Penetration-Test---vsftpd-2.3.4-Exploit @@ -184,6 +186,7 @@ vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which - https://github.com/dr3amz23/CEH-Project-PiyushVerma - https://github.com/dreighton90/megacorpone-penetration-test - https://github.com/durjoy-10/CYBER_NOTE +- https://github.com/e0n9/PenTest-Lab-1 - https://github.com/e0n9/PenTest_Lab_1 - https://github.com/enoughdurgesh/CEH-Project - https://github.com/everythingBlackkk/vsFTPd-Backdoor-Exploit-CVE-2011-2523- diff --git a/2014/CVE-2014-0160.md b/2014/CVE-2014-0160.md index 238572056f..9262e1ecb9 100644 --- a/2014/CVE-2014-0160.md +++ b/2014/CVE-2014-0160.md @@ -454,6 +454,7 @@ The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not p - https://github.com/john3955/john3955 - https://github.com/joneswu456/rt-n56u - https://github.com/jottama/pentesting +- https://github.com/jtuckery/seguridadinteresante - https://github.com/jubalh/awesome-package-maintainer - https://github.com/jweny/pocassistdb - https://github.com/k4u5h41/CVE-2014-0160_Heartbleed diff --git a/2014/CVE-2014-6271.md b/2014/CVE-2014-6271.md index 689dace08a..cc7baa17f1 100644 --- a/2014/CVE-2014-6271.md +++ b/2014/CVE-2014-6271.md @@ -529,6 +529,7 @@ GNU Bash through 4.3 processes trailing strings after function definitions in th - https://github.com/jli149/Incident-handling-with-Splunk - https://github.com/jmedeng/suriya73-exploits - https://github.com/jottama/pentesting +- https://github.com/jtuckery/seguridadinteresante - https://github.com/justone0127/Red-Hat-Advanced-Cluster-Security-for-Kubernetes-Operator-Installation - https://github.com/justone0127/Red-Hat-Cluster-Security-for-Kubernetes-Operator-Installation - https://github.com/justzx2011/bash-up diff --git a/2017/CVE-2017-17554.md b/2017/CVE-2017-17554.md index df21c3794f..39fba2c178 100644 --- a/2017/CVE-2017-17554.md +++ b/2017/CVE-2017-17554.md @@ -10,6 +10,7 @@ A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_s ### POC #### Reference +- https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20%20aubio_source_avcodec_readframe%20of%20aubio.md - https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference(DoS)%20Vulnerability%20was%20found%20in%20function%20%20aubio_source_avcodec_readframe%20of%20aubio.md #### Github diff --git a/2017/CVE-2017-17555.md b/2017/CVE-2017-17555.md index 7be0c90892..1dae70426d 100644 --- a/2017/CVE-2017-17555.md +++ b/2017/CVE-2017-17555.md @@ -10,6 +10,7 @@ The swri_audio_convert function in audioconvert.c in FFmpeg libswresample throug ### POC #### Reference +- https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md - https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference(DoS)%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md #### Github diff --git a/2017/CVE-2017-18733.md b/2017/CVE-2017-18733.md new file mode 100644 index 0000000000..81bae1d8a9 --- /dev/null +++ b/2017/CVE-2017-18733.md @@ -0,0 +1,17 @@ +### [CVE-2017-18733](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18733) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.28, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.8, R6400 before 1.0.1.22, R6400v2 before 1.0.2.32, R7100LG before 1.0.0.32, R7300DST before 1.0.0.52, R8300 before 1.0.2.94, and R8500 before 1.0.2.100. + +### POC + +#### Reference +- https://kb.netgear.com/000051522/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-Gateways-PSV-2016-0061 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-7921.md b/2017/CVE-2017-7921.md index 5c0fb750a3..6d49e013da 100644 --- a/2017/CVE-2017-7921.md +++ b/2017/CVE-2017-7921.md @@ -42,6 +42,7 @@ No PoCs from references. - https://github.com/LearnGolang/LearnGolang - https://github.com/MisakaMikato/cve-2017-7921-golang - https://github.com/Mr-xn/Penetration_Testing_POC +- https://github.com/ROYSCANNER/ROY - https://github.com/SexyBeast233/SecBooks - https://github.com/SlickxMercy/BETAVDB - https://github.com/SlickxMercy/WeakPassword diff --git a/2017/CVE-2017-8295.md b/2017/CVE-2017-8295.md index 473d3d4183..7b1ada3903 100644 --- a/2017/CVE-2017-8295.md +++ b/2017/CVE-2017-8295.md @@ -32,6 +32,7 @@ WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-ma - https://github.com/alphaSeclab/sec-daily-2019 - https://github.com/beelzebielsk/csc59938-week-7 - https://github.com/cyberheartmi9/CVE-2017-8295 +- https://github.com/d-roman-halliday/simple_cd_stripper - https://github.com/harrystaley/CSCI4349_Week9_Honeypot - https://github.com/harrystaley/TAMUSA_CSCI4349_Week9_Honeypot - https://github.com/holisticon/hack-yourself diff --git a/2019/CVE-2019-11358.md b/2019/CVE-2019-11358.md index dd5fd98bd4..5e48161202 100644 --- a/2019/CVE-2019-11358.md +++ b/2019/CVE-2019-11358.md @@ -850,6 +850,7 @@ jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishan - https://github.com/Couragethegod/FTC_Powerplay - https://github.com/Couragethegod/PowerPLay2 - https://github.com/CowCowFuture/s2auto +- https://github.com/Cr-N/DecodePrepBit-Mo - https://github.com/Cr1sb/ToTheStars - https://github.com/CrazyClone55/SJS-Robotics-Codebase - https://github.com/CrazyMoosen/Loose-Screws-2022-2023 @@ -3785,6 +3786,7 @@ jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishan - https://github.com/Zoarial94/8509-2023-Robot-Code - https://github.com/Zomope/sharetest - https://github.com/aaa1g5/Summer2024Test +- https://github.com/aaalliii/Team-Tumar-FGC - https://github.com/aabdeldayem1/FTC-2023 - https://github.com/aabdul78/Penetration-Test - https://github.com/aairahsofi/preseason-ftc-sdk diff --git a/2020/CVE-2020-0796.md b/2020/CVE-2020-0796.md index ad09c9fb0f..430d63643f 100644 --- a/2020/CVE-2020-0796.md +++ b/2020/CVE-2020-0796.md @@ -231,6 +231,7 @@ A remote code execution vulnerability exists in the way that the Microsoft Serve - https://github.com/cory-zajicek/CVE-2020-0796-DoS - https://github.com/cyb3rpeace/Active-Directory-Exploitation-Cheat-Sheet - https://github.com/cyberanand1337x/bug-bounty-2022 +- https://github.com/cybermads/CVE-2020-0796 - https://github.com/d4n-sec/d4n-sec.github.io - https://github.com/danielbodnar/my-awesome-stars - https://github.com/danigargu/CVE-2020-0796 diff --git a/2020/CVE-2020-3187.md b/2020/CVE-2020-3187.md index 7893fbde00..25036440f2 100644 --- a/2020/CVE-2020-3187.md +++ b/2020/CVE-2020-3187.md @@ -34,6 +34,7 @@ A vulnerability in the web services interface of Cisco Adaptive Security Applian - https://github.com/Threekiii/Awesome-POC - https://github.com/XiaomingX/awesome-poc-for-red-team - https://github.com/Z0fhack/Goby_POC +- https://github.com/cyb0rgdoll/reconresource - https://github.com/d4n-sec/d4n-sec.github.io - https://github.com/developer3000S/PoC-in-GitHub - https://github.com/hectorgie/PoC-in-GitHub diff --git a/2020/CVE-2020-7934.md b/2020/CVE-2020-7934.md index e3263d1a24..bfc948915c 100644 --- a/2020/CVE-2020-7934.md +++ b/2020/CVE-2020-7934.md @@ -19,6 +19,7 @@ In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and L - https://github.com/ARPSyndicate/cvemon - https://github.com/Sergio235705/audit-xss-cve-2020-7934 - https://github.com/developer3000S/PoC-in-GitHub +- https://github.com/giardinas-dev/audit-xss-cve-2020-7934 - https://github.com/hectorgie/PoC-in-GitHub - https://github.com/nomi-sec/PoC-in-GitHub - https://github.com/soosmile/POC diff --git a/2021/CVE-2021-21551.md b/2021/CVE-2021-21551.md index 73a6413713..c1ae9a36e4 100644 --- a/2021/CVE-2021-21551.md +++ b/2021/CVE-2021-21551.md @@ -66,6 +66,7 @@ Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability - https://github.com/manas3c/CVE-POC - https://github.com/mathisvickie/CVE-2021-21551 - https://github.com/mathisvickie/KMAC +- https://github.com/mikuofficial/theHandler-BOF - https://github.com/mzakocs/CVE-2021-21551-POC - https://github.com/n0-traces/cve_monitor - https://github.com/nanabingies/CVE-2021-21551 diff --git a/2021/CVE-2021-26855.md b/2021/CVE-2021-26855.md index 404fca4935..5dceebe678 100644 --- a/2021/CVE-2021-26855.md +++ b/2021/CVE-2021-26855.md @@ -144,6 +144,7 @@ Microsoft Exchange Server Remote Code Execution Vulnerability - https://github.com/conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855 - https://github.com/cryptolakk/ProxyLogon-Mass-RCE - https://github.com/ct-scorch/Security-Assessment-Findings-Report +- https://github.com/cyb0rgdoll/reconresource - https://github.com/cyb3r-w0lf/nuclei-template-collection - https://github.com/cyberanand1337x/bug-bounty-2022 - https://github.com/cyware-labs/Operation-Exchange-Marauder diff --git a/2021/CVE-2021-33044.md b/2021/CVE-2021-33044.md index 661b8c68f3..902c008453 100644 --- a/2021/CVE-2021-33044.md +++ b/2021/CVE-2021-33044.md @@ -33,6 +33,7 @@ The identity authentication bypass vulnerability found in some Dahua products du - https://github.com/Spy0x7/CVE-2021-33044 - https://github.com/Stealzoz/steal - https://github.com/Teryila/DahuaConsole +- https://github.com/Teryila/NoteMeDahua - https://github.com/WhaleFell/CameraHack - https://github.com/WhooAmii/POC_to_review - https://github.com/Z0fhack/Goby_POC diff --git a/2021/CVE-2021-33045.md b/2021/CVE-2021-33045.md index b84c42498e..6decd8c3bd 100644 --- a/2021/CVE-2021-33045.md +++ b/2021/CVE-2021-33045.md @@ -27,6 +27,7 @@ The identity authentication bypass vulnerability found in some Dahua products du - https://github.com/NyxAzrael/Goby_POC - https://github.com/Stealzoz/steal - https://github.com/Teryila/DahuaConsole +- https://github.com/Teryila/NoteMeDahua - https://github.com/WhaleFell/CameraHack - https://github.com/Z0fhack/Goby_POC - https://github.com/blkgzs/CameraHack diff --git a/2021/CVE-2021-36260.md b/2021/CVE-2021-36260.md index 2313316b36..b1a1b7bb75 100644 --- a/2021/CVE-2021-36260.md +++ b/2021/CVE-2021-36260.md @@ -57,6 +57,7 @@ A command injection vulnerability in the web server of some Hikvision product. D - https://github.com/NyxAzrael/Goby_POC - https://github.com/Ostorlab/KEV - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors +- https://github.com/ROYSCANNER/ROY - https://github.com/SYRTI/POC_to_review - https://github.com/ShivamB25/shodan-cam - https://github.com/SlickxMercy/WebCamHack diff --git a/2022/CVE-2022-1592.md b/2022/CVE-2022-1592.md index d25d0064a0..756fe248cc 100644 --- a/2022/CVE-2022-1592.md +++ b/2022/CVE-2022-1592.md @@ -14,5 +14,6 @@ Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scou #### Github - https://github.com/ARPSyndicate/cvemon +- https://github.com/AdnanApriliyansyahh/SCRIPT - https://github.com/nhienit2010/Vulnerability diff --git a/2022/CVE-2022-22965.md b/2022/CVE-2022-22965.md index 085b53ec3f..942a6cce76 100644 --- a/2022/CVE-2022-22965.md +++ b/2022/CVE-2022-22965.md @@ -106,6 +106,7 @@ A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable t - https://github.com/NCSC-NL/spring4shell - https://github.com/NaInSec/CVE-PoC-in-GitHub - https://github.com/NodyHub/fifi +- https://github.com/Nosie12/fire-wall-server - https://github.com/NyxAzrael/Goby_POC - https://github.com/OWASP/www-project-ide-vulscanner - https://github.com/Omaraitbenhaddi/-Spring4Shell-CVE-2022-22965- @@ -349,6 +350,7 @@ A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable t - https://github.com/onewinner/VulToolsKit - https://github.com/onurgule/S4S-Scanner - https://github.com/opennms-forge/opennms-spring-patched +- https://github.com/osungjinwoo/CVE-2022-22965 - https://github.com/p1ckzi/CVE-2022-22965 - https://github.com/pan258/webserverapp - https://github.com/paulseo0827/Amazon-EKS-Security diff --git a/2022/CVE-2022-27228.md b/2022/CVE-2022-27228.md index e4f5f7b2c8..091dee1226 100644 --- a/2022/CVE-2022-27228.md +++ b/2022/CVE-2022-27228.md @@ -18,6 +18,7 @@ No PoCs from references. - https://github.com/ARPSyndicate/cvemon - https://github.com/HiMiC/bitrix_scan - https://github.com/JackPot777/bitrix +- https://github.com/cleverg0d/bitrix-nuclei-templates - https://github.com/cyb3r-w0lf/nuclei-template-collection - https://github.com/nomi-sec/PoC-in-GitHub - https://github.com/trump88/CVE-2022-27228 diff --git a/2022/CVE-2022-46432.md b/2022/CVE-2022-46432.md index b8a534cc77..d20f43cccc 100644 --- a/2022/CVE-2022-46432.md +++ b/2022/CVE-2022-46432.md @@ -10,6 +10,7 @@ An exploitable firmware modification vulnerability was discovered on TP-Link TL- ### POC #### Reference +- https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/B1Vgv1uwo - https://hackmd.io/@slASVrz_SrW7NQCsunofeA/B1Vgv1uwo #### Github diff --git a/2023/CVE-2023-22894.md b/2023/CVE-2023-22894.md index 6417666701..6b77e26570 100644 --- a/2023/CVE-2023-22894.md +++ b/2023/CVE-2023-22894.md @@ -16,6 +16,7 @@ Strapi through 4.5.5 allows attackers (with access to the admin panel) to discov #### Github - https://github.com/ARPSyndicate/cvemon +- https://github.com/PuddinCat/GithubRepoSpider - https://github.com/Saboor-Hakimi/CVE-2023-22894 - https://github.com/maxntv24/CVE-2023-22894-PoC - https://github.com/nomi-sec/PoC-in-GitHub diff --git a/2023/CVE-2023-2775.md b/2023/CVE-2023-2775.md index bf6f3bfe73..ba52dceed8 100644 --- a/2023/CVE-2023-2775.md +++ b/2023/CVE-2023-2775.md @@ -11,7 +11,7 @@ Es wurde eine Schwachstelle in code-projects Bus Dispatch and Information System ### POC #### Reference -No PoCs from references. +- https://vuldb.com/?id.229281 #### Github - https://github.com/1-tong/vehicle_cves diff --git a/2023/CVE-2023-30861.md b/2023/CVE-2023-30861.md index 6c8e3dab5f..dea69b861e 100644 --- a/2023/CVE-2023-30861.md +++ b/2023/CVE-2023-30861.md @@ -17,6 +17,7 @@ No PoCs from references. - https://github.com/DevGreick/VulnHunter - https://github.com/HotDB-Community/HotDB-Engine - https://github.com/JawadPy/CVE-2023-30861-Exploit +- https://github.com/PreistlyPython/security-scanner-mcp - https://github.com/SenhorDosSonhos1/projeto-voluntario-lacrei - https://github.com/crumpman/pulsecheck - https://github.com/elifesciences/github-repo-security-alerts diff --git a/2023/CVE-2023-45878.md b/2023/CVE-2023-45878.md index e46c5f3e64..68655fe576 100644 --- a/2023/CVE-2023-45878.md +++ b/2023/CVE-2023-45878.md @@ -18,6 +18,8 @@ GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because r - https://github.com/20142995/nuclei-templates - https://github.com/Can0I0Ever0Enter/CVE-2023-45878 - https://github.com/PaulDHaes/CVE-2023-45878-POC +- https://github.com/byt3loss/CVE-2023-45878_to_RCE +- https://github.com/byt3loss/OffensiveScripts - https://github.com/cyb3r-w0lf/nuclei-template-collection - https://github.com/davidzzo23/CVE-2023-45878 - https://github.com/dgoorden/CVE-2023-45878 diff --git a/2023/CVE-2023-46818.md b/2023/CVE-2023-46818.md index 0e31141364..fd621d1c07 100644 --- a/2023/CVE-2023-46818.md +++ b/2023/CVE-2023-46818.md @@ -26,6 +26,7 @@ An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be - https://github.com/eetukarttunen/security-testing - https://github.com/engranaabubakar/CVE-2023-46818 - https://github.com/hunntr/CVE-2023-46818 +- https://github.com/mridulchamoli93/htb-md- - https://github.com/plzheheplztrying/cve_monitor - https://github.com/rvizx/CVE-2023-46818 - https://github.com/vulnerk0/CVE-2023-46818 diff --git a/2024/CVE-2024-0012.md b/2024/CVE-2024-0012.md index 6ecf0c4323..5afde8cadd 100644 --- a/2024/CVE-2024-0012.md +++ b/2024/CVE-2024-0012.md @@ -36,6 +36,7 @@ An authentication bypass in Palo Alto Networks PAN-OS software enables an unauth - https://github.com/crosswk/paloalto-cve-parser - https://github.com/cyb3r-w0lf/nuclei-template-collection - https://github.com/dcollaoa/cve-2024-0012-gui-poc +- https://github.com/felipealfonsog/felipealfonsog - https://github.com/greaselovely/CVE-2024-0012 - https://github.com/iSee857/CVE-2024-0012-poc - https://github.com/k4nfr3/CVE-2024-9474 diff --git a/2024/CVE-2024-1234.md b/2024/CVE-2024-1234.md index 4b222492ff..860ee5a9a1 100644 --- a/2024/CVE-2024-1234.md +++ b/2024/CVE-2024-1234.md @@ -61,6 +61,7 @@ No PoCs from references. - https://github.com/douglasfideles/DDSBuilder - https://github.com/douglasfideles/DDSVulnerabilitiesSearch - https://github.com/dumpnidadai/Ethical_Final +- https://github.com/hatlesswizard/PatchLeaks - https://github.com/hruthwikkk/vulnerability_scanner - https://github.com/isarax3al/CognitiveVulnerabilityManager - https://github.com/jayvishaalj/JSON_Vulnerability_Scan_Parser diff --git a/2024/CVE-2024-21626.md b/2024/CVE-2024-21626.md index e615ace29b..230b2e84d8 100644 --- a/2024/CVE-2024-21626.md +++ b/2024/CVE-2024-21626.md @@ -25,7 +25,9 @@ runc is a CLI tool for spawning and running containers on Linux according to the - https://github.com/Maissacrement/cyber_sec_master_spv - https://github.com/Metarget/metarget - https://github.com/NitroCao/CVE-2024-21626 +- https://github.com/PuddinCat/GithubRepoSpider - https://github.com/R3DRUN3/R3DRUN3 +- https://github.com/R4mbb/CVE-2024-21626 - https://github.com/Sk3pper/CVE-2024-21626 - https://github.com/Sk3pper/CVE-2024-21626-old-docker-versions - https://github.com/SrcVme50/Runner diff --git a/2024/CVE-2024-25177.md b/2024/CVE-2024-25177.md new file mode 100644 index 0000000000..1e77f9c53b --- /dev/null +++ b/2024/CVE-2024-25177.md @@ -0,0 +1,17 @@ +### [CVE-2024-25177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25177) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS). + +### POC + +#### Reference +- https://github.com/LuaJIT/LuaJIT/issues/1147 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-25178.md b/2024/CVE-2024-25178.md new file mode 100644 index 0000000000..b01bec90f0 --- /dev/null +++ b/2024/CVE-2024-25178.md @@ -0,0 +1,17 @@ +### [CVE-2024-25178](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25178) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c. + +### POC + +#### Reference +- https://github.com/LuaJIT/LuaJIT/issues/1152 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-25217.md b/2024/CVE-2024-25217.md index 3fa98b7593..0280ca1d19 100644 --- a/2024/CVE-2024-25217.md +++ b/2024/CVE-2024-25217.md @@ -10,6 +10,7 @@ Online Medicine Ordering System v1.0 was discovered to contain a SQL injection v ### POC #### Reference +- https://github.com/BurakSevben/CVEs/blob/main/Online%20Medicine%20Ordering%20System/OMOS%20-%20SQL%20Injection%28Unauthenticated%29.md - https://github.com/BurakSevben/CVEs/blob/main/Online%20Medicine%20Ordering%20System/OMOS%20-%20SQL%20Injection(Unauthenticated).md #### Github diff --git a/2024/CVE-2024-27199.md b/2024/CVE-2024-27199.md index 58df5d1baa..4a0ef803dd 100644 --- a/2024/CVE-2024-27199.md +++ b/2024/CVE-2024-27199.md @@ -10,6 +10,7 @@ In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limite ### POC #### Reference +- https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py - https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive #### Github diff --git a/2024/CVE-2024-30085.md b/2024/CVE-2024-30085.md index e02d257cf8..e4a6c9740d 100644 --- a/2024/CVE-2024-30085.md +++ b/2024/CVE-2024-30085.md @@ -33,6 +33,7 @@ No PoCs from references. #### Github - https://github.com/ARPSyndicate/cve-scores - https://github.com/Adamkadaban/CVE-2024-30085 +- https://github.com/ghostbyt3/WinDriver-EXP - https://github.com/murdok1982/Exploit-PoC-para-CVE-2024-30085 - https://github.com/myseq/ms_patch_tuesday - https://github.com/nomi-sec/PoC-in-GitHub diff --git a/2024/CVE-2024-3552.md b/2024/CVE-2024-3552.md index 77856c8009..be91904c1c 100644 --- a/2024/CVE-2024-3552.md +++ b/2024/CVE-2024-3552.md @@ -20,6 +20,7 @@ The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escap - https://github.com/KiPhuong/cve-2024-3552 - https://github.com/Lern0n/Lernon-POC - https://github.com/Linxloop/fork_POC +- https://github.com/PuddinCat/GithubRepoSpider - https://github.com/Warren-Jace/poc-doc - https://github.com/WhosGa/MyWiki - https://github.com/Yuan08o/pocs diff --git a/2024/CVE-2024-41110.md b/2024/CVE-2024-41110.md index d94a47ec7c..919709b449 100644 --- a/2024/CVE-2024-41110.md +++ b/2024/CVE-2024-41110.md @@ -36,6 +36,7 @@ No PoCs from references. - https://github.com/EGI-Federation/SVG-advisories - https://github.com/PauloParoPP/CVE-2024-41110-SCAN - https://github.com/h4ckm1n-dev/report-test +- https://github.com/lampensau/server-setup - https://github.com/nomi-sec/PoC-in-GitHub - https://github.com/rancher/vexhub - https://github.com/vvpoglazov/cve-2024-41110-checker diff --git a/2024/CVE-2024-43425.md b/2024/CVE-2024-43425.md index 7eee301e0c..064a244b14 100644 --- a/2024/CVE-2024-43425.md +++ b/2024/CVE-2024-43425.md @@ -20,6 +20,7 @@ No PoCs from references. - https://github.com/PuddinCat/GithubRepoSpider - https://github.com/RedTeamPentesting/moodle-rce-calculatedquestions - https://github.com/Snizi/Moodle-CVE-2024-43425-Exploit +- https://github.com/aayush256-sys/Moodle-authenticated-RCE - https://github.com/aninfosec/CVE-2024-43425-Poc - https://github.com/nomi-sec/PoC-in-GitHub - https://github.com/plzheheplztrying/cve_monitor diff --git a/2024/CVE-2024-48580.md b/2024/CVE-2024-48580.md index 6136a2564f..49251f9581 100644 --- a/2024/CVE-2024-48580.md +++ b/2024/CVE-2024-48580.md @@ -11,6 +11,7 @@ SQL Injection vulnerability in Best courier management system in php v.1.0 allow ### POC #### Reference +- https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20SQL%20Injection%20%28Admin%20Login%29.md - https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20SQL%20Injection%20(Admin%20Login).md #### Github diff --git a/2024/CVE-2024-5154.md b/2024/CVE-2024-5154.md index f70a5ea305..be73724e71 100644 --- a/2024/CVE-2024-5154.md +++ b/2024/CVE-2024-5154.md @@ -2,7 +2,6 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%203.11&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.12&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.13&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.14&color=blue) diff --git a/2024/CVE-2024-56732.md b/2024/CVE-2024-56732.md new file mode 100644 index 0000000000..866c2e1b06 --- /dev/null +++ b/2024/CVE-2024-56732.md @@ -0,0 +1,17 @@ +### [CVE-2024-56732](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56732) +![](https://img.shields.io/static/v1?label=Product&message=harfbuzz&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%208.5.0%2C%20%3C%3D%2010.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%3A%20Heap-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function. + +### POC + +#### Reference +- https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-25763.md b/2025/CVE-2025-25763.md index 37b0927ab3..423247f7c8 100644 --- a/2025/CVE-2025-25763.md +++ b/2025/CVE-2025-25763.md @@ -14,6 +14,7 @@ No PoCs from references. #### Github - https://github.com/ARPSyndicate/docs +- https://github.com/Oyst3r1ng/CVE-2025-25763 - https://github.com/nomi-sec/PoC-in-GitHub - https://github.com/plzheheplztrying/cve_monitor diff --git a/2025/CVE-2025-26062.md b/2025/CVE-2025-26062.md index 5110fe14b4..31e1972027 100644 --- a/2025/CVE-2025-26062.md +++ b/2025/CVE-2025-26062.md @@ -14,4 +14,5 @@ An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows una #### Github - https://github.com/fkie-cad/nvd-json-data-feeds +- https://github.com/thexnumb/thexwriteup diff --git a/2025/CVE-2025-27515.md b/2025/CVE-2025-27515.md index ecee1b55b7..fe7d1b32a7 100644 --- a/2025/CVE-2025-27515.md +++ b/2025/CVE-2025-27515.md @@ -15,4 +15,5 @@ No PoCs from references. #### Github - https://github.com/macropay-solutions/laravel-crud-wizard-free +- https://github.com/mubbi/laravel-flysystem-huawei-obs diff --git a/2025/CVE-2025-27889.md b/2025/CVE-2025-27889.md index 9fdcc05717..6f8b4bb57a 100644 --- a/2025/CVE-2025-27889.md +++ b/2025/CVE-2025-27889.md @@ -10,6 +10,7 @@ Wing FTP Server before 7.4.4 does not properly validate and sanitize the url par ### POC #### Reference +- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27889.txt - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ #### Github diff --git a/2025/CVE-2025-29927.md b/2025/CVE-2025-29927.md index 9119f26ee3..e666f1ef91 100644 --- a/2025/CVE-2025-29927.md +++ b/2025/CVE-2025-29927.md @@ -40,6 +40,7 @@ No PoCs from references. - https://github.com/Anoulakdev/PPC_Front - https://github.com/Arham47/NextJs_tailwind_admin_Dashboard - https://github.com/AshifurNahid/rtgs-frontend +- https://github.com/AshwinH08111999/my-nextjs-app - https://github.com/AsipreVerse/qualiweb-admin - https://github.com/AsriGaluhKirana/modulRawatInap-Asri - https://github.com/AventurineJun/CVE-2025-29927-Research @@ -89,6 +90,7 @@ No PoCs from references. - https://github.com/Ichmella19/MentisCare - https://github.com/IhsanulAfkar/executive-ai-chatbot - https://github.com/ImamAsyariAlmaturidi/new-olaai-dashboard +- https://github.com/InffelIntegracoes/zeus_app - https://github.com/Intellidevelopers/femopay-admin - https://github.com/J1ezds/Vulnerability-Wiki-page - https://github.com/JairPrada/radar-col @@ -178,6 +180,8 @@ No PoCs from references. - https://github.com/ZeYrOxXx1/Web-Tasks - https://github.com/Zoli1212/kpi - https://github.com/a-s-m-asadujjaman/exploitables +- https://github.com/aayush256-sys/next-js-auth-bypass +- https://github.com/aayush256-sys/nextjs-auth-bypass-poc - https://github.com/abduhamid707/SELLER_SIDE - https://github.com/abhishek-rc/GWA-IOT-UI - https://github.com/adnan-kutay-yuksel/tryhackme-all-rooms-database @@ -236,6 +240,7 @@ No PoCs from references. - https://github.com/enochgitgamefied/NextJS-CVE-2025-29927-Docker-Lab - https://github.com/ernestgm/adonplay-frontend - https://github.com/ernestgm/adonplay-player +- https://github.com/eslamelshenawy611/dwaa - https://github.com/ethanol1310/POC-CVE-2025-29927- - https://github.com/fahimalshihab/NextBypass - https://github.com/fandofastest/fadel @@ -292,6 +297,7 @@ No PoCs from references. - https://github.com/jitmondal1/OSCP - https://github.com/jmbowes/NextSecureScan - https://github.com/jon-on-nostr/eventstr +- https://github.com/josdndev/SignaLife - https://github.com/josdndev/Signaapp - https://github.com/josdndev/signa.app - https://github.com/jtsamzg/Nextjs-Tailwind-Admin-Template @@ -414,6 +420,7 @@ No PoCs from references. - https://github.com/tanjiti/sec_profile - https://github.com/tanvi-rathod-techno/next-panel - https://github.com/techleadevelopers/social-tech-in-media +- https://github.com/thexnumb/thexwriteup - https://github.com/thmrevenant/tryhackme - https://github.com/thuyit1996/course - https://github.com/ticofookfook/poc-nextjs-CVE-2025-29927 diff --git a/2025/CVE-2025-30066.md b/2025/CVE-2025-30066.md index 4b88b2ebf5..b3bfd2ad65 100644 --- a/2025/CVE-2025-30066.md +++ b/2025/CVE-2025-30066.md @@ -25,4 +25,5 @@ tj-actions changed-files before 46 allows remote attackers to discover secrets b - https://github.com/ramimac/aws-customer-security-incidents - https://github.com/step-security/harden-runner - https://github.com/ums91/CISA_BOT +- https://github.com/yuya-takeyama/replicate-docker-version-tag-action diff --git a/2025/CVE-2025-30208.md b/2025/CVE-2025-30208.md index 7e1c5a1ece..8bbbf98292 100644 --- a/2025/CVE-2025-30208.md +++ b/2025/CVE-2025-30208.md @@ -63,6 +63,7 @@ Vite, a provider of frontend development tooling, has a vulnerability in version - https://github.com/sadhfdw129/CVE-2025-30208-Vite - https://github.com/sumeet-darekar/CVE-2025-30208 - https://github.com/tanjiti/sec_profile +- https://github.com/warung-madura/cse - https://github.com/xaitx/CVE-2025-30208 - https://github.com/xuemian168/CVE-2025-30208 diff --git a/2025/CVE-2025-32462.md b/2025/CVE-2025-32462.md index fbb9e62064..c4abf8641d 100644 --- a/2025/CVE-2025-32462.md +++ b/2025/CVE-2025-32462.md @@ -15,6 +15,7 @@ No PoCs from references. #### Github - https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462 - https://github.com/CryingN/CVE-2025-32462 +- https://github.com/Dlodlos/CVE-2025-32463-lab - https://github.com/Ilansos/ansible-sudo-cve2025-patch - https://github.com/MAAYTHM/CVE-2025-32462_32463-Lab - https://github.com/MGunturG/CVE-2025-32463 diff --git a/2025/CVE-2025-32463.md b/2025/CVE-2025-32463.md index 3ba776b7df..532d6d3702 100644 --- a/2025/CVE-2025-32463.md +++ b/2025/CVE-2025-32463.md @@ -27,6 +27,7 @@ Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswi - https://github.com/CIA911/sudo_patch_CVE-2025-32463 - https://github.com/ChetanKomal/sudo_exploit - https://github.com/Chocapikk/CVE-2025-32463-lab +- https://github.com/Dlodlos/CVE-2025-32463-lab - https://github.com/Floodnut/CVE-2025-32463 - https://github.com/FoxSecIntel/Vulnerability-Analysis - https://github.com/FreeDurok/CVE-2025-32463-PoC diff --git a/2025/CVE-2025-34100.md b/2025/CVE-2025-34100.md index 2e5057fb61..64e3cfb22a 100644 --- a/2025/CVE-2025-34100.md +++ b/2025/CVE-2025-34100.md @@ -16,5 +16,5 @@ An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the - https://www.exploit-db.com/exploits/40390 #### Github -No PoCs found on GitHub currently. +- https://github.com/yembors64632/cve_monitor_Public diff --git a/2025/CVE-2025-3969.md b/2025/CVE-2025-3969.md index c742f734a6..ab08f85da6 100644 --- a/2025/CVE-2025-3969.md +++ b/2025/CVE-2025-3969.md @@ -16,6 +16,7 @@ Eine Schwachstelle wurde in codeprojects News Publishing Site Dashboard 1.0 ausg #### Github - https://github.com/Alif145/CVE-2025-3969-Exploit +- https://github.com/PuddinCat/GithubRepoSpider - https://github.com/Stuub/CVE-2025-3969-Exploit - https://github.com/nomi-sec/PoC-in-GitHub - https://github.com/plzheheplztrying/cve_monitor diff --git a/2025/CVE-2025-41373.md b/2025/CVE-2025-41373.md new file mode 100644 index 0000000000..d4529efcdf --- /dev/null +++ b/2025/CVE-2025-41373.md @@ -0,0 +1,20 @@ +### [CVE-2025-41373](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-41373) +![](https://img.shields.io/static/v1?label=Product&message=Gandia%20Integra%20Total&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.1.2217.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/PuddinCat/GithubRepoSpider +- https://github.com/byteReaper77/CVE-2025-41373 +- https://github.com/nomi-sec/PoC-in-GitHub +- https://github.com/yembors64632/cve_monitor_Public + diff --git a/2025/CVE-2025-44136.md b/2025/CVE-2025-44136.md index c3732f4635..c24225f59f 100644 --- a/2025/CVE-2025-44136.md +++ b/2025/CVE-2025-44136.md @@ -10,7 +10,8 @@ MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GE ### POC #### Reference -No PoCs from references. +- https://github.com/maptiler/tileserver-php/issues/167 +- https://github.com/mheranco/CVE-2025-44136 #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-44137.md b/2025/CVE-2025-44137.md index 3297832fe7..dd84a1d478 100644 --- a/2025/CVE-2025-44137.md +++ b/2025/CVE-2025-44137.md @@ -10,7 +10,8 @@ MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTil ### POC #### Reference -No PoCs from references. +- https://github.com/maptiler/tileserver-php/issues/167 +- https://github.com/mheranco/CVE-2025-44137 #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-44559.md b/2025/CVE-2025-44559.md new file mode 100644 index 0000000000..7f1ae049d8 --- /dev/null +++ b/2025/CVE-2025-44559.md @@ -0,0 +1,17 @@ +### [CVE-2025-44559](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-44559) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets. + +### POC + +#### Reference +- https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Realtek/Cross-layer_Interaction_Deadlock.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-51384.md b/2025/CVE-2025-51384.md index 8044751abd..50e0321f6c 100644 --- a/2025/CVE-2025-51384.md +++ b/2025/CVE-2025-51384.md @@ -14,4 +14,5 @@ No PoCs from references. #### Github - https://github.com/fkie-cad/nvd-json-data-feeds +- https://github.com/thexnumb/thexwriteup diff --git a/2025/CVE-2025-51503.md b/2025/CVE-2025-51503.md index b91298c8b3..bc8185b7b0 100644 --- a/2025/CVE-2025-51503.md +++ b/2025/CVE-2025-51503.md @@ -14,4 +14,5 @@ No PoCs from references. #### Github - https://github.com/fkie-cad/nvd-json-data-feeds +- https://github.com/thexnumb/thexwriteup diff --git a/2025/CVE-2025-5301.md b/2025/CVE-2025-5301.md index 1a041c5f41..6d75fbdc06 100644 --- a/2025/CVE-2025-5301.md +++ b/2025/CVE-2025-5301.md @@ -10,6 +10,7 @@ ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected ### POC #### Reference +- http://seclists.org/fulldisclosure/2025/Jun/18 - https://r.sec-consult.com/onlyoffice - https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/ diff --git a/2025/CVE-2025-53770.md b/2025/CVE-2025-53770.md index 56aad4b0c5..6d884ab3f8 100644 --- a/2025/CVE-2025-53770.md +++ b/2025/CVE-2025-53770.md @@ -51,6 +51,7 @@ Deserialization of untrusted data in on-premises Microsoft SharePoint Server all - https://github.com/giterlizzi/secdb-feeds - https://github.com/grupooruss/CVE-2025-53770-Checker - https://github.com/haKC-ai/panhandlr +- https://github.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC - https://github.com/hazcod/CVE-2025-53770 - https://github.com/imbas007/CVE-2025-53770-Vulnerable-Scanner - https://github.com/inverzeio/media diff --git a/2025/CVE-2025-54388.md b/2025/CVE-2025-54388.md new file mode 100644 index 0000000000..766832e78c --- /dev/null +++ b/2025/CVE-2025-54388.md @@ -0,0 +1,17 @@ +### [CVE-2025-54388](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54388) +![](https://img.shields.io/static/v1?label=Product&message=moby&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%2028.2.0%2C%20%3C%2028.3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-909%3A%20Missing%20Initialization%20of%20Resource&color=brightgreen) + +### Description + +Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/DockerDiscordControl/DockerDiscordControl + diff --git a/2025/CVE-2025-54782.md b/2025/CVE-2025-54782.md new file mode 100644 index 0000000000..c6586cd650 --- /dev/null +++ b/2025/CVE-2025-54782.md @@ -0,0 +1,19 @@ +### [CVE-2025-54782](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54782) +![](https://img.shields.io/static/v1?label=Product&message=nest&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-77%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20a%20Command%20('Command%20Injection')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc + diff --git a/2025/CVE-2025-6105.md b/2025/CVE-2025-6105.md new file mode 100644 index 0000000000..b7770d4d50 --- /dev/null +++ b/2025/CVE-2025-6105.md @@ -0,0 +1,19 @@ +### [CVE-2025-6105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6105) +![](https://img.shields.io/static/v1?label=Product&message=jfinal_cms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross-Site%20Request%20Forgery&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. +In jflyfox jfinal_cms 5.0.1 wurde eine problematische Schwachstelle gefunden. Hierbei betrifft es unbekannten Programmcode der Datei HOME.java. Durch das Beeinflussen des Arguments Logout mit unbekannten Daten kann eine cross-site request forgery-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung. + +### POC + +#### Reference +- https://vuldb.com/?id.312574 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-7847.md b/2025/CVE-2025-7847.md new file mode 100644 index 0000000000..7496d7dba8 --- /dev/null +++ b/2025/CVE-2025-7847.md @@ -0,0 +1,19 @@ +### [CVE-2025-7847](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7847) +![](https://img.shields.io/static/v1?label=Product&message=AI%20Engine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.9.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen) + +### Description + +The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/EricArdiansa/CVE-2025-7847-POC +- https://github.com/PuddinCat/GithubRepoSpider +- https://github.com/nomi-sec/PoC-in-GitHub + diff --git a/2025/CVE-2025-8220.md b/2025/CVE-2025-8220.md index ef56cf72a0..3f64874a03 100644 --- a/2025/CVE-2025-8220.md +++ b/2025/CVE-2025-8220.md @@ -7,8 +7,8 @@ ### Description -A vulnerability classified as critical has been found in Engeman Web up to 12.0.0.1. Affected is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. -Es wurde eine kritische Schwachstelle in Engeman Web bis 12.0.0.1 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /Login/RecoveryPass der Komponente Password Recovery Page. Durch das Manipulieren des Arguments LanguageCombobox mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung. +A vulnerability classified as critical has been found in Engeman Web up to 12.0.0.1. Affected is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. +Es wurde eine kritische Schwachstelle in Engeman Web bis 12.0.0.1 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /Login/RecoveryPass der Komponente Password Recovery Page. Durch das Manipulieren des Arguments LanguageCombobox durch Cookie kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung. ### POC diff --git a/2025/CVE-2025-8468.md b/2025/CVE-2025-8468.md new file mode 100644 index 0000000000..4fb96b4587 --- /dev/null +++ b/2025/CVE-2025-8468.md @@ -0,0 +1,19 @@ +### [CVE-2025-8468](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8468) +![](https://img.shields.io/static/v1?label=Product&message=Wazifa%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /controllers/reset.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. +Eine kritische Schwachstelle wurde in code-projects Wazifa System 1.0 ausgemacht. Betroffen davon ist ein unbekannter Prozess der Datei /controllers/reset.php. Mit der Manipulation des Arguments email mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/fkie-cad/nvd-json-data-feeds + diff --git a/2025/CVE-2025-8469.md b/2025/CVE-2025-8469.md new file mode 100644 index 0000000000..e47ff30994 --- /dev/null +++ b/2025/CVE-2025-8469.md @@ -0,0 +1,19 @@ +### [CVE-2025-8469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8469) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Hotel%20Reservation%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/deletegallery.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. +Es wurde eine Schwachstelle in SourceCodester Online Hotel Reservation System 1.0 entdeckt. Sie wurde als kritisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf der Datei /admin/deletegallery.php. Durch die Manipulation des Arguments ID mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/fkie-cad/nvd-json-data-feeds + diff --git a/github.txt b/github.txt index b431e25dd9..e9579b4c69 100644 --- a/github.txt +++ b/github.txt @@ -9954,6 +9954,7 @@ CVE-2011-2523 - https://github.com/ParmatmaKumar/Ethical_hacking_project CVE-2011-2523 - https://github.com/ParmeshwarSao/Project-EH CVE-2011-2523 - https://github.com/Patrick122333/4240project CVE-2011-2523 - https://github.com/Paulineclv/Port-Scanner +CVE-2011-2523 - https://github.com/Prabashana20/Penetration-Testing-Kali-vs-Metasploitable CVE-2011-2523 - https://github.com/Prachi-Sharma-git/Exploit_FTP CVE-2011-2523 - https://github.com/Prakanth20/Network-Scanner-with-Banner-Grabbing-and-CVE-Detection CVE-2011-2523 - https://github.com/Pritt014/metasploitable2-pentest @@ -10017,6 +10018,7 @@ CVE-2011-2523 - https://github.com/chleba124/vsftpd-exploit CVE-2011-2523 - https://github.com/coolsikandarakr/CEH-Training-Project CVE-2011-2523 - https://github.com/cowsecurity/CVE-2011-2523 CVE-2011-2523 - https://github.com/csk/unisecbarber +CVE-2011-2523 - https://github.com/cybermads/CVE-2011-2523 CVE-2011-2523 - https://github.com/deboogo/metasploitable-analysis CVE-2011-2523 - https://github.com/deepdarkworld/EXPLOIT_CVE CVE-2011-2523 - https://github.com/delsawright/Hotel-Dorsey-Penetration-Test---vsftpd-2.3.4-Exploit @@ -10026,6 +10028,7 @@ CVE-2011-2523 - https://github.com/doval2222/scripts-ciberseguridad CVE-2011-2523 - https://github.com/dr3amz23/CEH-Project-PiyushVerma CVE-2011-2523 - https://github.com/dreighton90/megacorpone-penetration-test CVE-2011-2523 - https://github.com/durjoy-10/CYBER_NOTE +CVE-2011-2523 - https://github.com/e0n9/PenTest-Lab-1 CVE-2011-2523 - https://github.com/e0n9/PenTest_Lab_1 CVE-2011-2523 - https://github.com/enoughdurgesh/CEH-Project CVE-2011-2523 - https://github.com/everythingBlackkk/vsFTPd-Backdoor-Exploit-CVE-2011-2523- @@ -16380,6 +16383,7 @@ CVE-2014-0160 - https://github.com/jerryxk/awesome-hacking CVE-2014-0160 - https://github.com/john3955/john3955 CVE-2014-0160 - https://github.com/joneswu456/rt-n56u CVE-2014-0160 - https://github.com/jottama/pentesting +CVE-2014-0160 - https://github.com/jtuckery/seguridadinteresante CVE-2014-0160 - https://github.com/jubalh/awesome-package-maintainer CVE-2014-0160 - https://github.com/jweny/pocassistdb CVE-2014-0160 - https://github.com/k4u5h41/CVE-2014-0160_Heartbleed @@ -19715,6 +19719,7 @@ CVE-2014-6271 - https://github.com/jj1bdx/bash-3.2-osx-fix CVE-2014-6271 - https://github.com/jli149/Incident-handling-with-Splunk CVE-2014-6271 - https://github.com/jmedeng/suriya73-exploits CVE-2014-6271 - https://github.com/jottama/pentesting +CVE-2014-6271 - https://github.com/jtuckery/seguridadinteresante CVE-2014-6271 - https://github.com/justone0127/Red-Hat-Advanced-Cluster-Security-for-Kubernetes-Operator-Installation CVE-2014-6271 - https://github.com/justone0127/Red-Hat-Cluster-Security-for-Kubernetes-Operator-Installation CVE-2014-6271 - https://github.com/justzx2011/bash-up @@ -51112,6 +51117,7 @@ CVE-2017-7921 - https://github.com/K3ysTr0K3R/K3ysTr0K3R CVE-2017-7921 - https://github.com/LearnGolang/LearnGolang CVE-2017-7921 - https://github.com/MisakaMikato/cve-2017-7921-golang CVE-2017-7921 - https://github.com/Mr-xn/Penetration_Testing_POC +CVE-2017-7921 - https://github.com/ROYSCANNER/ROY CVE-2017-7921 - https://github.com/SexyBeast233/SecBooks CVE-2017-7921 - https://github.com/SlickxMercy/BETAVDB CVE-2017-7921 - https://github.com/SlickxMercy/WeakPassword @@ -51375,6 +51381,7 @@ CVE-2017-8295 - https://github.com/alash3al/wp-allowed-hosts CVE-2017-8295 - https://github.com/alphaSeclab/sec-daily-2019 CVE-2017-8295 - https://github.com/beelzebielsk/csc59938-week-7 CVE-2017-8295 - https://github.com/cyberheartmi9/CVE-2017-8295 +CVE-2017-8295 - https://github.com/d-roman-halliday/simple_cd_stripper CVE-2017-8295 - https://github.com/harrystaley/CSCI4349_Week9_Honeypot CVE-2017-8295 - https://github.com/harrystaley/TAMUSA_CSCI4349_Week9_Honeypot CVE-2017-8295 - https://github.com/holisticon/hack-yourself @@ -74304,6 +74311,7 @@ CVE-2019-11358 - https://github.com/CouGears/FTC_2022-2023 CVE-2019-11358 - https://github.com/Couragethegod/FTC_Powerplay CVE-2019-11358 - https://github.com/Couragethegod/PowerPLay2 CVE-2019-11358 - https://github.com/CowCowFuture/s2auto +CVE-2019-11358 - https://github.com/Cr-N/DecodePrepBit-Mo CVE-2019-11358 - https://github.com/Cr1sb/ToTheStars CVE-2019-11358 - https://github.com/CrazyClone55/SJS-Robotics-Codebase CVE-2019-11358 - https://github.com/CrazyMoosen/Loose-Screws-2022-2023 @@ -77239,6 +77247,7 @@ CVE-2019-11358 - https://github.com/Ziyue-Xu/modularCode CVE-2019-11358 - https://github.com/Zoarial94/8509-2023-Robot-Code CVE-2019-11358 - https://github.com/Zomope/sharetest CVE-2019-11358 - https://github.com/aaa1g5/Summer2024Test +CVE-2019-11358 - https://github.com/aaalliii/Team-Tumar-FGC CVE-2019-11358 - https://github.com/aabdeldayem1/FTC-2023 CVE-2019-11358 - https://github.com/aabdul78/Penetration-Test CVE-2019-11358 - https://github.com/aairahsofi/preseason-ftc-sdk @@ -95959,6 +95968,7 @@ CVE-2020-0796 - https://github.com/coksl/oss-cloudes CVE-2020-0796 - https://github.com/cory-zajicek/CVE-2020-0796-DoS CVE-2020-0796 - https://github.com/cyb3rpeace/Active-Directory-Exploitation-Cheat-Sheet CVE-2020-0796 - https://github.com/cyberanand1337x/bug-bounty-2022 +CVE-2020-0796 - https://github.com/cybermads/CVE-2020-0796 CVE-2020-0796 - https://github.com/d4n-sec/d4n-sec.github.io CVE-2020-0796 - https://github.com/danielbodnar/my-awesome-stars CVE-2020-0796 - https://github.com/danigargu/CVE-2020-0796 @@ -112334,6 +112344,7 @@ CVE-2020-3187 - https://github.com/T4t4ru/CVE-2020-3187 CVE-2020-3187 - https://github.com/Threekiii/Awesome-POC CVE-2020-3187 - https://github.com/XiaomingX/awesome-poc-for-red-team CVE-2020-3187 - https://github.com/Z0fhack/Goby_POC +CVE-2020-3187 - https://github.com/cyb0rgdoll/reconresource CVE-2020-3187 - https://github.com/d4n-sec/d4n-sec.github.io CVE-2020-3187 - https://github.com/developer3000S/PoC-in-GitHub CVE-2020-3187 - https://github.com/hectorgie/PoC-in-GitHub @@ -116669,6 +116680,7 @@ CVE-2020-7934 - https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2 CVE-2020-7934 - https://github.com/ARPSyndicate/cvemon CVE-2020-7934 - https://github.com/Sergio235705/audit-xss-cve-2020-7934 CVE-2020-7934 - https://github.com/developer3000S/PoC-in-GitHub +CVE-2020-7934 - https://github.com/giardinas-dev/audit-xss-cve-2020-7934 CVE-2020-7934 - https://github.com/hectorgie/PoC-in-GitHub CVE-2020-7934 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2020-7934 - https://github.com/soosmile/POC @@ -123185,6 +123197,7 @@ CVE-2021-21551 - https://github.com/luke0x90/CVE-2021-21551 CVE-2021-21551 - https://github.com/manas3c/CVE-POC CVE-2021-21551 - https://github.com/mathisvickie/CVE-2021-21551 CVE-2021-21551 - https://github.com/mathisvickie/KMAC +CVE-2021-21551 - https://github.com/mikuofficial/theHandler-BOF CVE-2021-21551 - https://github.com/mzakocs/CVE-2021-21551-POC CVE-2021-21551 - https://github.com/n0-traces/cve_monitor CVE-2021-21551 - https://github.com/nanabingies/CVE-2021-21551 @@ -129242,6 +129255,7 @@ CVE-2021-26855 - https://github.com/charlottelatest/CVE-2021-26855 CVE-2021-26855 - https://github.com/conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855 CVE-2021-26855 - https://github.com/cryptolakk/ProxyLogon-Mass-RCE CVE-2021-26855 - https://github.com/ct-scorch/Security-Assessment-Findings-Report +CVE-2021-26855 - https://github.com/cyb0rgdoll/reconresource CVE-2021-26855 - https://github.com/cyb3r-w0lf/nuclei-template-collection CVE-2021-26855 - https://github.com/cyberanand1337x/bug-bounty-2022 CVE-2021-26855 - https://github.com/cyware-labs/Operation-Exchange-Marauder @@ -135125,6 +135139,7 @@ CVE-2021-33044 - https://github.com/SlickxMercy/BETAVDB CVE-2021-33044 - https://github.com/Spy0x7/CVE-2021-33044 CVE-2021-33044 - https://github.com/Stealzoz/steal CVE-2021-33044 - https://github.com/Teryila/DahuaConsole +CVE-2021-33044 - https://github.com/Teryila/NoteMeDahua CVE-2021-33044 - https://github.com/WhaleFell/CameraHack CVE-2021-33044 - https://github.com/WhooAmii/POC_to_review CVE-2021-33044 - https://github.com/Z0fhack/Goby_POC @@ -135166,6 +135181,7 @@ CVE-2021-33045 - https://github.com/Nxychx/TVT-NVR CVE-2021-33045 - https://github.com/NyxAzrael/Goby_POC CVE-2021-33045 - https://github.com/Stealzoz/steal CVE-2021-33045 - https://github.com/Teryila/DahuaConsole +CVE-2021-33045 - https://github.com/Teryila/NoteMeDahua CVE-2021-33045 - https://github.com/WhaleFell/CameraHack CVE-2021-33045 - https://github.com/Z0fhack/Goby_POC CVE-2021-33045 - https://github.com/blkgzs/CameraHack @@ -138095,6 +138111,7 @@ CVE-2021-36260 - https://github.com/Nxychx/TVT-NVR CVE-2021-36260 - https://github.com/NyxAzrael/Goby_POC CVE-2021-36260 - https://github.com/Ostorlab/KEV CVE-2021-36260 - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors +CVE-2021-36260 - https://github.com/ROYSCANNER/ROY CVE-2021-36260 - https://github.com/SYRTI/POC_to_review CVE-2021-36260 - https://github.com/ShivamB25/shodan-cam CVE-2021-36260 - https://github.com/SlickxMercy/WebCamHack @@ -154287,6 +154304,7 @@ CVE-2022-1590 - https://github.com/karimhabush/cyberowl CVE-2022-1591 - https://github.com/20142995/nuclei-templates CVE-2022-1591 - https://github.com/ARPSyndicate/cvemon CVE-2022-1592 - https://github.com/ARPSyndicate/cvemon +CVE-2022-1592 - https://github.com/AdnanApriliyansyahh/SCRIPT CVE-2022-1592 - https://github.com/nhienit2010/Vulnerability CVE-2022-1593 - https://github.com/20142995/nuclei-templates CVE-2022-1594 - https://github.com/20142995/nuclei-templates @@ -158561,6 +158579,7 @@ CVE-2022-22965 - https://github.com/Mr-xn/spring-core-rce CVE-2022-22965 - https://github.com/NCSC-NL/spring4shell CVE-2022-22965 - https://github.com/NaInSec/CVE-PoC-in-GitHub CVE-2022-22965 - https://github.com/NodyHub/fifi +CVE-2022-22965 - https://github.com/Nosie12/fire-wall-server CVE-2022-22965 - https://github.com/NyxAzrael/Goby_POC CVE-2022-22965 - https://github.com/OWASP/www-project-ide-vulscanner CVE-2022-22965 - https://github.com/Omaraitbenhaddi/-Spring4Shell-CVE-2022-22965- @@ -158804,6 +158823,7 @@ CVE-2022-22965 - https://github.com/olanrewaju-M-Yusuf/Spring4Shell-Incident-Res CVE-2022-22965 - https://github.com/onewinner/VulToolsKit CVE-2022-22965 - https://github.com/onurgule/S4S-Scanner CVE-2022-22965 - https://github.com/opennms-forge/opennms-spring-patched +CVE-2022-22965 - https://github.com/osungjinwoo/CVE-2022-22965 CVE-2022-22965 - https://github.com/p1ckzi/CVE-2022-22965 CVE-2022-22965 - https://github.com/pan258/webserverapp CVE-2022-22965 - https://github.com/paulseo0827/Amazon-EKS-Security @@ -164667,6 +164687,7 @@ CVE-2022-27228 - https://github.com/56567853/bitrix CVE-2022-27228 - https://github.com/ARPSyndicate/cvemon CVE-2022-27228 - https://github.com/HiMiC/bitrix_scan CVE-2022-27228 - https://github.com/JackPot777/bitrix +CVE-2022-27228 - https://github.com/cleverg0d/bitrix-nuclei-templates CVE-2022-27228 - https://github.com/cyb3r-w0lf/nuclei-template-collection CVE-2022-27228 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2022-27228 - https://github.com/trump88/CVE-2022-27228 @@ -184077,6 +184098,7 @@ CVE-2023-2289 - https://github.com/20142995/nuclei-templates CVE-2023-22893 - https://github.com/20142995/nuclei-templates CVE-2023-22893 - https://github.com/ARPSyndicate/cvemon CVE-2023-22894 - https://github.com/ARPSyndicate/cvemon +CVE-2023-22894 - https://github.com/PuddinCat/GithubRepoSpider CVE-2023-22894 - https://github.com/Saboor-Hakimi/CVE-2023-22894 CVE-2023-22894 - https://github.com/maxntv24/CVE-2023-22894-PoC CVE-2023-22894 - https://github.com/nomi-sec/PoC-in-GitHub @@ -189427,6 +189449,7 @@ CVE-2023-30854 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2023-30861 - https://github.com/DevGreick/VulnHunter CVE-2023-30861 - https://github.com/HotDB-Community/HotDB-Engine CVE-2023-30861 - https://github.com/JawadPy/CVE-2023-30861-Exploit +CVE-2023-30861 - https://github.com/PreistlyPython/security-scanner-mcp CVE-2023-30861 - https://github.com/SenhorDosSonhos1/projeto-voluntario-lacrei CVE-2023-30861 - https://github.com/crumpman/pulsecheck CVE-2023-30861 - https://github.com/elifesciences/github-repo-security-alerts @@ -194976,6 +194999,7 @@ CVE-2023-39848 - https://github.com/diegoch49/Desarrollo CVE-2023-39848 - https://github.com/digininja/DVWA CVE-2023-39848 - https://github.com/djstevanovic98/DVWA-test CVE-2023-39848 - https://github.com/dtinedoeip/dss +CVE-2023-39848 - https://github.com/dummyhshz/DVWA CVE-2023-39848 - https://github.com/eashan98/dvwa CVE-2023-39848 - https://github.com/ekemena97/Jen CVE-2023-39848 - https://github.com/ekin-kaplan/dvwa-coverity @@ -195068,6 +195092,7 @@ CVE-2023-39848 - https://github.com/qhitor/practica CVE-2023-39848 - https://github.com/rachmatramadhan123/dvwa CVE-2023-39848 - https://github.com/rafaelmg27-ux/DVWA-Vulnerable CVE-2023-39848 - https://github.com/raju0123-k/DVWA +CVE-2023-39848 - https://github.com/rajutest0101/DVWA CVE-2023-39848 - https://github.com/ratedalex/TAREA5 CVE-2023-39848 - https://github.com/raza-jafy/DVWA CVE-2023-39848 - https://github.com/rbwlocks/DVWA @@ -198805,6 +198830,8 @@ CVE-2023-45878 - https://github.com/0xyy66/OffensiveScripts CVE-2023-45878 - https://github.com/20142995/nuclei-templates CVE-2023-45878 - https://github.com/Can0I0Ever0Enter/CVE-2023-45878 CVE-2023-45878 - https://github.com/PaulDHaes/CVE-2023-45878-POC +CVE-2023-45878 - https://github.com/byt3loss/CVE-2023-45878_to_RCE +CVE-2023-45878 - https://github.com/byt3loss/OffensiveScripts CVE-2023-45878 - https://github.com/cyb3r-w0lf/nuclei-template-collection CVE-2023-45878 - https://github.com/davidzzo23/CVE-2023-45878 CVE-2023-45878 - https://github.com/dgoorden/CVE-2023-45878 @@ -199607,6 +199634,7 @@ CVE-2023-46818 - https://github.com/blindma1den/CVE-2023-46818-Exploit CVE-2023-46818 - https://github.com/eetukarttunen/security-testing CVE-2023-46818 - https://github.com/engranaabubakar/CVE-2023-46818 CVE-2023-46818 - https://github.com/hunntr/CVE-2023-46818 +CVE-2023-46818 - https://github.com/mridulchamoli93/htb-md- CVE-2023-46818 - https://github.com/plzheheplztrying/cve_monitor CVE-2023-46818 - https://github.com/rvizx/CVE-2023-46818 CVE-2023-46818 - https://github.com/vulnerk0/CVE-2023-46818 @@ -210006,6 +210034,7 @@ CVE-2024-0012 - https://github.com/aratane/CVE-2024-9474 CVE-2024-0012 - https://github.com/crosswk/paloalto-cve-parser CVE-2024-0012 - https://github.com/cyb3r-w0lf/nuclei-template-collection CVE-2024-0012 - https://github.com/dcollaoa/cve-2024-0012-gui-poc +CVE-2024-0012 - https://github.com/felipealfonsog/felipealfonsog CVE-2024-0012 - https://github.com/greaselovely/CVE-2024-0012 CVE-2024-0012 - https://github.com/iSee857/CVE-2024-0012-poc CVE-2024-0012 - https://github.com/k4nfr3/CVE-2024-9474 @@ -213337,6 +213366,7 @@ CVE-2024-1234 - https://github.com/dhbarman/vulnerability CVE-2024-1234 - https://github.com/douglasfideles/DDSBuilder CVE-2024-1234 - https://github.com/douglasfideles/DDSVulnerabilitiesSearch CVE-2024-1234 - https://github.com/dumpnidadai/Ethical_Final +CVE-2024-1234 - https://github.com/hatlesswizard/PatchLeaks CVE-2024-1234 - https://github.com/hruthwikkk/vulnerability_scanner CVE-2024-1234 - https://github.com/isarax3al/CognitiveVulnerabilityManager CVE-2024-1234 - https://github.com/jayvishaalj/JSON_Vulnerability_Scan_Parser @@ -217465,7 +217495,9 @@ CVE-2024-21626 - https://github.com/KubernetesBachelor/CVE-2024-21626 CVE-2024-21626 - https://github.com/Maissacrement/cyber_sec_master_spv CVE-2024-21626 - https://github.com/Metarget/metarget CVE-2024-21626 - https://github.com/NitroCao/CVE-2024-21626 +CVE-2024-21626 - https://github.com/PuddinCat/GithubRepoSpider CVE-2024-21626 - https://github.com/R3DRUN3/R3DRUN3 +CVE-2024-21626 - https://github.com/R4mbb/CVE-2024-21626 CVE-2024-21626 - https://github.com/Sk3pper/CVE-2024-21626 CVE-2024-21626 - https://github.com/Sk3pper/CVE-2024-21626-old-docker-versions CVE-2024-21626 - https://github.com/SrcVme50/Runner @@ -225461,6 +225493,7 @@ CVE-2024-30084 - https://github.com/ghostbyt3/WinDriver-EXP CVE-2024-30084 - https://github.com/myseq/ms_patch_tuesday CVE-2024-30085 - https://github.com/ARPSyndicate/cve-scores CVE-2024-30085 - https://github.com/Adamkadaban/CVE-2024-30085 +CVE-2024-30085 - https://github.com/ghostbyt3/WinDriver-EXP CVE-2024-30085 - https://github.com/murdok1982/Exploit-PoC-para-CVE-2024-30085 CVE-2024-30085 - https://github.com/myseq/ms_patch_tuesday CVE-2024-30085 - https://github.com/nomi-sec/PoC-in-GitHub @@ -229533,6 +229566,7 @@ CVE-2024-3552 - https://github.com/KiPhuong/challenge-cve-2024-3552 CVE-2024-3552 - https://github.com/KiPhuong/cve-2024-3552 CVE-2024-3552 - https://github.com/Lern0n/Lernon-POC CVE-2024-3552 - https://github.com/Linxloop/fork_POC +CVE-2024-3552 - https://github.com/PuddinCat/GithubRepoSpider CVE-2024-3552 - https://github.com/Warren-Jace/poc-doc CVE-2024-3552 - https://github.com/WhosGa/MyWiki CVE-2024-3552 - https://github.com/Yuan08o/pocs @@ -233111,6 +233145,7 @@ CVE-2024-41110 - https://github.com/11notes/docker-github-runner CVE-2024-41110 - https://github.com/EGI-Federation/SVG-advisories CVE-2024-41110 - https://github.com/PauloParoPP/CVE-2024-41110-SCAN CVE-2024-41110 - https://github.com/h4ckm1n-dev/report-test +CVE-2024-41110 - https://github.com/lampensau/server-setup CVE-2024-41110 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2024-41110 - https://github.com/rancher/vexhub CVE-2024-41110 - https://github.com/vvpoglazov/cve-2024-41110-checker @@ -234538,6 +234573,7 @@ CVE-2024-43425 - https://github.com/20142995/nuclei-templates CVE-2024-43425 - https://github.com/PuddinCat/GithubRepoSpider CVE-2024-43425 - https://github.com/RedTeamPentesting/moodle-rce-calculatedquestions CVE-2024-43425 - https://github.com/Snizi/Moodle-CVE-2024-43425-Exploit +CVE-2024-43425 - https://github.com/aayush256-sys/Moodle-authenticated-RCE CVE-2024-43425 - https://github.com/aninfosec/CVE-2024-43425-Poc CVE-2024-43425 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2024-43425 - https://github.com/plzheheplztrying/cve_monitor @@ -253480,6 +253516,7 @@ CVE-2025-25749 - https://github.com/plzheheplztrying/cve_monitor CVE-2025-2575 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-25758 - https://github.com/priyanshukumar397/Auditor-portfolio CVE-2025-25763 - https://github.com/ARPSyndicate/docs +CVE-2025-25763 - https://github.com/Oyst3r1ng/CVE-2025-25763 CVE-2025-25763 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-25763 - https://github.com/plzheheplztrying/cve_monitor CVE-2025-25767 - https://github.com/fkie-cad/nvd-json-data-feeds @@ -253555,6 +253592,7 @@ CVE-2025-26056 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-26056 - https://github.com/plzheheplztrying/cve_monitor CVE-2025-26056 - https://github.com/rohan-pt/CVE-2025-26056 CVE-2025-26062 - https://github.com/fkie-cad/nvd-json-data-feeds +CVE-2025-26062 - https://github.com/thexnumb/thexwriteup CVE-2025-26063 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-26064 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-2609 - https://github.com/ARPSyndicate/cve-scores @@ -254050,6 +254088,7 @@ CVE-2025-27499 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-27510 - https://github.com/omnigodz/MDAVI CVE-2025-27514 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-27515 - https://github.com/macropay-solutions/laravel-crud-wizard-free +CVE-2025-27515 - https://github.com/mubbi/laravel-flysystem-huawei-obs CVE-2025-27516 - https://github.com/ARPSyndicate/cve-scores CVE-2025-27516 - https://github.com/PBorocz/raindrop-io-py CVE-2025-27520 - https://github.com/ARPSyndicate/cve-scores @@ -254617,6 +254656,7 @@ CVE-2025-29927 - https://github.com/AnonKryptiQuz/NextSploit CVE-2025-29927 - https://github.com/Anoulakdev/PPC_Front CVE-2025-29927 - https://github.com/Arham47/NextJs_tailwind_admin_Dashboard CVE-2025-29927 - https://github.com/AshifurNahid/rtgs-frontend +CVE-2025-29927 - https://github.com/AshwinH08111999/my-nextjs-app CVE-2025-29927 - https://github.com/AsipreVerse/qualiweb-admin CVE-2025-29927 - https://github.com/AsriGaluhKirana/modulRawatInap-Asri CVE-2025-29927 - https://github.com/AventurineJun/CVE-2025-29927-Research @@ -254666,6 +254706,7 @@ CVE-2025-29927 - https://github.com/IAmNullPointer/whatsapp-bot-admin CVE-2025-29927 - https://github.com/Ichmella19/MentisCare CVE-2025-29927 - https://github.com/IhsanulAfkar/executive-ai-chatbot CVE-2025-29927 - https://github.com/ImamAsyariAlmaturidi/new-olaai-dashboard +CVE-2025-29927 - https://github.com/InffelIntegracoes/zeus_app CVE-2025-29927 - https://github.com/Intellidevelopers/femopay-admin CVE-2025-29927 - https://github.com/J1ezds/Vulnerability-Wiki-page CVE-2025-29927 - https://github.com/JairPrada/radar-col @@ -254755,6 +254796,8 @@ CVE-2025-29927 - https://github.com/ZakirCodeArchitect/TailAdmin CVE-2025-29927 - https://github.com/ZeYrOxXx1/Web-Tasks CVE-2025-29927 - https://github.com/Zoli1212/kpi CVE-2025-29927 - https://github.com/a-s-m-asadujjaman/exploitables +CVE-2025-29927 - https://github.com/aayush256-sys/next-js-auth-bypass +CVE-2025-29927 - https://github.com/aayush256-sys/nextjs-auth-bypass-poc CVE-2025-29927 - https://github.com/abduhamid707/SELLER_SIDE CVE-2025-29927 - https://github.com/abhishek-rc/GWA-IOT-UI CVE-2025-29927 - https://github.com/adnan-kutay-yuksel/tryhackme-all-rooms-database @@ -254813,6 +254856,7 @@ CVE-2025-29927 - https://github.com/enochgitgamefied/NextJS-CVE-2025-29927 CVE-2025-29927 - https://github.com/enochgitgamefied/NextJS-CVE-2025-29927-Docker-Lab CVE-2025-29927 - https://github.com/ernestgm/adonplay-frontend CVE-2025-29927 - https://github.com/ernestgm/adonplay-player +CVE-2025-29927 - https://github.com/eslamelshenawy611/dwaa CVE-2025-29927 - https://github.com/ethanol1310/POC-CVE-2025-29927- CVE-2025-29927 - https://github.com/fahimalshihab/NextBypass CVE-2025-29927 - https://github.com/fandofastest/fadel @@ -254869,6 +254913,7 @@ CVE-2025-29927 - https://github.com/jishnucodes/e-commerce-admin-dashboard CVE-2025-29927 - https://github.com/jitmondal1/OSCP CVE-2025-29927 - https://github.com/jmbowes/NextSecureScan CVE-2025-29927 - https://github.com/jon-on-nostr/eventstr +CVE-2025-29927 - https://github.com/josdndev/SignaLife CVE-2025-29927 - https://github.com/josdndev/Signaapp CVE-2025-29927 - https://github.com/josdndev/signa.app CVE-2025-29927 - https://github.com/jtsamzg/Nextjs-Tailwind-Admin-Template @@ -254991,6 +255036,7 @@ CVE-2025-29927 - https://github.com/taminhle/WORKSHOP CVE-2025-29927 - https://github.com/tanjiti/sec_profile CVE-2025-29927 - https://github.com/tanvi-rathod-techno/next-panel CVE-2025-29927 - https://github.com/techleadevelopers/social-tech-in-media +CVE-2025-29927 - https://github.com/thexnumb/thexwriteup CVE-2025-29927 - https://github.com/thmrevenant/tryhackme CVE-2025-29927 - https://github.com/thuyit1996/course CVE-2025-29927 - https://github.com/ticofookfook/poc-nextjs-CVE-2025-29927 @@ -255091,6 +255137,7 @@ CVE-2025-30066 - https://github.com/plzheheplztrying/cve_monitor CVE-2025-30066 - https://github.com/ramimac/aws-customer-security-incidents CVE-2025-30066 - https://github.com/step-security/harden-runner CVE-2025-30066 - https://github.com/ums91/CISA_BOT +CVE-2025-30066 - https://github.com/yuya-takeyama/replicate-docker-version-tag-action CVE-2025-30072 - https://github.com/ARPSyndicate/cve-scores CVE-2025-30076 - https://github.com/gl0wyy/koha-task-scheduler-rce CVE-2025-30087 - https://github.com/w4zu/Debian_security @@ -255202,6 +255249,7 @@ CVE-2025-30208 - https://github.com/r0ngy40/CVE-2025-30208-Series CVE-2025-30208 - https://github.com/sadhfdw129/CVE-2025-30208-Vite CVE-2025-30208 - https://github.com/sumeet-darekar/CVE-2025-30208 CVE-2025-30208 - https://github.com/tanjiti/sec_profile +CVE-2025-30208 - https://github.com/warung-madura/cse CVE-2025-30208 - https://github.com/xaitx/CVE-2025-30208 CVE-2025-30208 - https://github.com/xuemian168/CVE-2025-30208 CVE-2025-30211 - https://github.com/ARPSyndicate/cve-scores @@ -255959,6 +256007,7 @@ CVE-2025-32445 - https://github.com/ARPSyndicate/cve-scores CVE-2025-3245 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-32462 - https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462 CVE-2025-32462 - https://github.com/CryingN/CVE-2025-32462 +CVE-2025-32462 - https://github.com/Dlodlos/CVE-2025-32463-lab CVE-2025-32462 - https://github.com/Ilansos/ansible-sudo-cve2025-patch CVE-2025-32462 - https://github.com/MAAYTHM/CVE-2025-32462_32463-Lab CVE-2025-32462 - https://github.com/MGunturG/CVE-2025-32463 @@ -255988,6 +256037,7 @@ CVE-2025-32463 - https://github.com/B1ack4sh/Blackash-CVE-2025-32463 CVE-2025-32463 - https://github.com/CIA911/sudo_patch_CVE-2025-32463 CVE-2025-32463 - https://github.com/ChetanKomal/sudo_exploit CVE-2025-32463 - https://github.com/Chocapikk/CVE-2025-32463-lab +CVE-2025-32463 - https://github.com/Dlodlos/CVE-2025-32463-lab CVE-2025-32463 - https://github.com/Floodnut/CVE-2025-32463 CVE-2025-32463 - https://github.com/FoxSecIntel/Vulnerability-Analysis CVE-2025-32463 - https://github.com/FreeDurok/CVE-2025-32463-PoC @@ -256347,6 +256397,7 @@ CVE-2025-3409 - https://github.com/ARPSyndicate/cve-scores CVE-2025-3410 - https://github.com/ARPSyndicate/cve-scores CVE-2025-3410 - https://github.com/Tr0e/CVE_Hunter CVE-2025-3410 - https://github.com/honorseclab/vulns +CVE-2025-34100 - https://github.com/yembors64632/cve_monitor_Public CVE-2025-34104 - https://github.com/ARPSyndicate/cve-scores CVE-2025-3411 - https://github.com/Tr0e/CVE_Hunter CVE-2025-3411 - https://github.com/honorseclab/vulns @@ -256780,6 +256831,7 @@ CVE-2025-39601 - https://github.com/Nxploited/CVE-2025-39601 CVE-2025-39601 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-39601 - https://github.com/plzheheplztrying/cve_monitor CVE-2025-3969 - https://github.com/Alif145/CVE-2025-3969-Exploit +CVE-2025-3969 - https://github.com/PuddinCat/GithubRepoSpider CVE-2025-3969 - https://github.com/Stuub/CVE-2025-3969-Exploit CVE-2025-3969 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-3969 - https://github.com/plzheheplztrying/cve_monitor @@ -256929,6 +256981,10 @@ CVE-2025-41255 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-41256 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-4131 - https://github.com/ARPSyndicate/cve-scores CVE-2025-4134 - https://github.com/ARPSyndicate/cve-scores +CVE-2025-41373 - https://github.com/PuddinCat/GithubRepoSpider +CVE-2025-41373 - https://github.com/byteReaper77/CVE-2025-41373 +CVE-2025-41373 - https://github.com/nomi-sec/PoC-in-GitHub +CVE-2025-41373 - https://github.com/yembors64632/cve_monitor_Public CVE-2025-4138 - https://github.com/11notes/docker-paperless-ngx CVE-2025-4138 - https://github.com/GitHubForSnap/matrix-commander-gael CVE-2025-4138 - https://github.com/fkie-cad/nvd-json-data-feeds @@ -258391,6 +258447,7 @@ CVE-2025-50270 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-50340 - https://github.com/millad7/SOGo_web_mail-vulnerability-CVE-2025-50340 CVE-2025-50340 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-50340 - https://github.com/yembors64632/cve_monitor_Public +CVE-2025-50341 - https://github.com/PuddinCat/GithubRepoSpider CVE-2025-50341 - https://github.com/millad7/Axelor-vulnerability-CVE-2025-50341 CVE-2025-50341 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-50341 - https://github.com/yembors64632/cve_monitor_Public @@ -258521,6 +258578,7 @@ CVE-2025-5127 - https://github.com/YZS17/CVE CVE-2025-5137 - https://github.com/ARPSyndicate/cve-scores CVE-2025-51383 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-51384 - https://github.com/fkie-cad/nvd-json-data-feeds +CVE-2025-51384 - https://github.com/thexnumb/thexwriteup CVE-2025-51385 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-51385 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-51385 - https://github.com/saarcastified/CVE-2023-51385---OpenSSH-ProxyCommand-Injection-PoC @@ -258554,6 +258612,7 @@ CVE-2025-5150 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-51501 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-51502 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-51503 - https://github.com/fkie-cad/nvd-json-data-feeds +CVE-2025-51503 - https://github.com/thexnumb/thexwriteup CVE-2025-51504 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-5151 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-5152 - https://github.com/fkie-cad/nvd-json-data-feeds @@ -258849,6 +258908,7 @@ CVE-2025-53770 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-53770 - https://github.com/giterlizzi/secdb-feeds CVE-2025-53770 - https://github.com/grupooruss/CVE-2025-53770-Checker CVE-2025-53770 - https://github.com/haKC-ai/panhandlr +CVE-2025-53770 - https://github.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC CVE-2025-53770 - https://github.com/hazcod/CVE-2025-53770 CVE-2025-53770 - https://github.com/imbas007/CVE-2025-53770-Vulnerable-Scanner CVE-2025-53770 - https://github.com/inverzeio/media @@ -258935,6 +258995,9 @@ CVE-2025-54085 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-54127 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-54128 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-54134 - https://github.com/fkie-cad/nvd-json-data-feeds +CVE-2025-54135 - https://github.com/PuddinCat/GithubRepoSpider +CVE-2025-54135 - https://github.com/allinsthon/CVE-2025-54135 +CVE-2025-54135 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-54138 - https://github.com/skraft9/cve-publications CVE-2025-54138 - https://github.com/skraft9/librenms-security-research CVE-2025-5419 - https://github.com/PuddinCat/GithubRepoSpider @@ -258970,6 +259033,7 @@ CVE-2025-5438 - https://github.com/ARPSyndicate/cve-scores CVE-2025-54381 - https://github.com/PuddinCat/GithubRepoSpider CVE-2025-54381 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-54381 - https://github.com/rockmelodies/bentoml_CVE-2025-54381 +CVE-2025-54388 - https://github.com/DockerDiscordControl/DockerDiscordControl CVE-2025-5439 - https://github.com/ARPSyndicate/cve-scores CVE-2025-54392 - https://github.com/ARPSyndicate/cve-scores CVE-2025-5440 - https://github.com/ARPSyndicate/cve-scores @@ -259024,6 +259088,7 @@ CVE-2025-5473 - https://github.com/w4zu/Debian_security CVE-2025-54769 - https://github.com/PuddinCat/GithubRepoSpider CVE-2025-54769 - https://github.com/byteReaper77/CVE-2025-54769 CVE-2025-54769 - https://github.com/nomi-sec/PoC-in-GitHub +CVE-2025-54782 - https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc CVE-2025-54832 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-54833 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-54834 - https://github.com/fkie-cad/nvd-json-data-feeds @@ -259579,6 +259644,9 @@ CVE-2025-7823 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-7824 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-7840 - https://github.com/byteReaper77/CVE-2025-7840 CVE-2025-7840 - https://github.com/nomi-sec/PoC-in-GitHub +CVE-2025-7847 - https://github.com/EricArdiansa/CVE-2025-7847-POC +CVE-2025-7847 - https://github.com/PuddinCat/GithubRepoSpider +CVE-2025-7847 - https://github.com/nomi-sec/PoC-in-GitHub CVE-2025-7863 - https://github.com/zast-ai/vulnerability-reports CVE-2025-7864 - https://github.com/zast-ai/vulnerability-reports CVE-2025-7865 - https://github.com/zast-ai/vulnerability-reports @@ -259772,6 +259840,8 @@ CVE-2025-8408 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-8409 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-8426 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-8454 - https://github.com/fkie-cad/nvd-json-data-feeds +CVE-2025-8468 - https://github.com/fkie-cad/nvd-json-data-feeds +CVE-2025-8469 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-8472 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-8473 - https://github.com/fkie-cad/nvd-json-data-feeds CVE-2025-8474 - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/references.txt b/references.txt index d1dde4f14a..3133f7f52f 100644 --- a/references.txt +++ b/references.txt @@ -49049,7 +49049,9 @@ CVE-2017-17539 - https://fortiguard.com/advisory/FG-IR-17-274 CVE-2017-17540 - https://fortiguard.com/advisory/FG-IR-17-274 CVE-2017-17541 - https://fortiguard.com/advisory/FG-IR-17-305 CVE-2017-17543 - https://fortiguard.com/advisory/FG-IR-17-214 +CVE-2017-17554 - https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20%20aubio_source_avcodec_readframe%20of%20aubio.md CVE-2017-17554 - https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference(DoS)%20Vulnerability%20was%20found%20in%20function%20%20aubio_source_avcodec_readframe%20of%20aubio.md +CVE-2017-17555 - https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md CVE-2017-17555 - https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference(DoS)%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md CVE-2017-17557 - https://blog.0patch.com/2018/05/0patching-foxit-reader-buffer-oops.html CVE-2017-17557 - https://www.foxitsoftware.com/support/security-bulletins.php @@ -49746,6 +49748,7 @@ CVE-2017-18729 - https://kb.netgear.com/000051526/Security-Advisory-for-Pre-Auth CVE-2017-18730 - https://kb.netgear.com/000051525/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2134 CVE-2017-18731 - https://kb.netgear.com/000051524/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2016-0096 CVE-2017-18732 - https://kb.netgear.com/000051523/Security-Advisory-for-Authentication-Bypass-on-R6300v2-PLW1000v2-and-PLW1010v2-PSV-2016-0069 +CVE-2017-18733 - https://kb.netgear.com/000051522/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-Gateways-PSV-2016-0061 CVE-2017-18734 - https://kb.netgear.com/000051521/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2154 CVE-2017-18735 - https://kb.netgear.com/000051520/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Extenders-PSV-2017-2143 CVE-2017-18738 - https://kb.netgear.com/000051517/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Extenders-PSV-2017-0706 @@ -98028,6 +98031,7 @@ CVE-2022-46428 - https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1hP34Hvj CVE-2022-46428 - https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1hP34Hvj CVE-2022-46430 - https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BJxlw2Pwi CVE-2022-46430 - https://hackmd.io/@slASVrz_SrW7NQCsunofeA/BJxlw2Pwi +CVE-2022-46432 - https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/B1Vgv1uwo CVE-2022-46432 - https://hackmd.io/@slASVrz_SrW7NQCsunofeA/B1Vgv1uwo CVE-2022-46434 - https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/rJl69Icws CVE-2022-46434 - https://hackmd.io/@slASVrz_SrW7NQCsunofeA/rJl69Icws @@ -101544,6 +101548,7 @@ CVE-2023-27739 - https://threeshield.ca/easyxdm-2.5.20.html CVE-2023-27742 - https://github.com/G37SYS73M/CVE-2023-27742 CVE-2023-27744 - https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf CVE-2023-27745 - https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf +CVE-2023-2775 - https://vuldb.com/?id.229281 CVE-2023-27754 - https://github.com/10cksYiqiyinHangzhouTechnology/vox2mesh_poc CVE-2023-27775 - https://github.com/marcovntr/CVE/blob/main/2023/CVE-2023-27775/CVE-2023-27775.md CVE-2023-27779 - https://docs.google.com/document/d/1kGzmc6AOCfRzJf9mDz4emkhQj84Y1XemmAMZjYK32-o/edit?usp=sharing @@ -109997,6 +110002,8 @@ CVE-2024-25169 - https://github.com/shenhav12/CVE-2024-25169-Mezzanine-v6.0.0 CVE-2024-2517 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Blind%20SQL%20Injection%20-%20book_history.php.md CVE-2024-25170 - https://github.com/shenhav12/CVE-2024-25170-Mezzanine-v6.0.0 CVE-2024-25176 - https://github.com/LuaJIT/LuaJIT/issues/1149 +CVE-2024-25177 - https://github.com/LuaJIT/LuaJIT/issues/1147 +CVE-2024-25178 - https://github.com/LuaJIT/LuaJIT/issues/1152 CVE-2024-2518 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/MAGESH-K21%20%20Online-College-Event-Hall-Reservation-System/Reflected%20XSS%20-%20book_history.php.md CVE-2024-25180 - https://github.com/joaoviictorti/My-CVES/blob/main/CVE-2024-25180/README.md CVE-2024-25180 - https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-6347243 @@ -110022,6 +110029,7 @@ CVE-2024-25213 - https://github.com/BurakSevben/CVEs/blob/main/Employee%20Manage CVE-2024-25214 - https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20Authentication%20Bypass.md CVE-2024-25215 - https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%202.md CVE-2024-25216 - https://github.com/BurakSevben/CVEs/blob/main/Employee%20Management%20System/Employee%20Managment%20System%20-%20SQL%20Injection%20-%201.md +CVE-2024-25217 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Medicine%20Ordering%20System/OMOS%20-%20SQL%20Injection%28Unauthenticated%29.md CVE-2024-25217 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Medicine%20Ordering%20System/OMOS%20-%20SQL%20Injection(Unauthenticated).md CVE-2024-25218 - https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-1.md CVE-2024-25219 - https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-%202.md @@ -110434,6 +110442,7 @@ CVE-2024-27179 - http://seclists.org/fulldisclosure/2024/Jul/1 CVE-2024-27180 - http://seclists.org/fulldisclosure/2024/Jul/1 CVE-2024-2719 - https://vuldb.com/?id.257472 CVE-2024-27198 - https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive +CVE-2024-27199 - https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py CVE-2024-27199 - https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive CVE-2024-2720 - https://vuldb.com/?id.257473 CVE-2024-27279 - https://jvn.jp/en/jp/JVN48443978/ @@ -114191,6 +114200,7 @@ CVE-2024-4857 - https://wpscan.com/vulnerability/bf1b8434-b361-4666-9058-d9f08c0 CVE-2024-48570 - https://github.com/Luc1f3r066/Client-Management-System-v1.0- CVE-2024-48579 - https://github.com/baineoli/CVE/blob/main/2024/house%20rental%20management%20system%20-%20SQL%20Injection%20%28Admin%20Login%29.md CVE-2024-48579 - https://github.com/baineoli/CVE/blob/main/2024/house%20rental%20management%20system%20-%20SQL%20Injection%20(Admin%20Login).md +CVE-2024-48580 - https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20SQL%20Injection%20%28Admin%20Login%29.md CVE-2024-48580 - https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20SQL%20Injection%20(Admin%20Login).md CVE-2024-48581 - https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20Unrestricted%20File%20Upload%20to%20RCE%20(Sign%20Up).md CVE-2024-48589 - https://github.com/Exek1el/CVE-2024-48589 @@ -115124,6 +115134,7 @@ CVE-2024-5658 - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-A CVE-2024-56669 - https://git.kernel.org/stable/c/9a0a72d3ed919ebe6491f527630998be053151d8 CVE-2024-56705 - https://git.kernel.org/stable/c/0c25ab93f2878cab07d37ca5afd302283201e5af CVE-2024-5672 - http://seclists.org/fulldisclosure/2024/Jul/6 +CVE-2024-56732 - https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m CVE-2024-5676 - http://seclists.org/fulldisclosure/2024/Jun/8 CVE-2024-5676 - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery CVE-2024-56826 - https://github.com/uclouvain/openjpeg/issues/1563 @@ -118154,6 +118165,7 @@ CVE-2025-27803 - https://r.sec-consult.com/echarge CVE-2025-27804 - https://r.sec-consult.com/echarge CVE-2025-27829 - https://advisories.stormshield.eu/2025-002/ CVE-2025-27840 - https://flyingpenguin.com/?p=67838 +CVE-2025-27889 - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27889.txt CVE-2025-27889 - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ CVE-2025-27892 - https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-001/ CVE-2025-27910 - https://github.com/xujeff/tianti/issues/39 @@ -119225,6 +119237,10 @@ CVE-2025-44109 - https://drive.google.com/file/d/12XY2WFBvGJ104gUvyG6YDIEdy4y1gl CVE-2025-44109 - https://gist.github.com/Suuuuuzy/609c7b2e74a8cc16c8e0302a100b86e0 CVE-2025-44115 - https://gist.github.com/yA0-Z/9666b1a333607381ab8dfcc137f2b65c CVE-2025-44115 - https://github.com/Cotonti/Cotonti/issues/1650 +CVE-2025-44136 - https://github.com/maptiler/tileserver-php/issues/167 +CVE-2025-44136 - https://github.com/mheranco/CVE-2025-44136 +CVE-2025-44137 - https://github.com/maptiler/tileserver-php/issues/167 +CVE-2025-44137 - https://github.com/mheranco/CVE-2025-44137 CVE-2025-44148 - https://github.com/barisbaydur/CVE-2025-44148 CVE-2025-44163 - https://gist.github.com/YichaoXu/3694f039a3d1b973efd068e4dc662a41 CVE-2025-4417 - https://www.aveva.com/en/support-and-success/cyber-security-updates/ @@ -119244,6 +119260,7 @@ CVE-2025-44528 - https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/TI CVE-2025-44531 - https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Realtek/Pairing_Random_Before_Pairing_Public_Key.md CVE-2025-4455 - https://gist.github.com/shellkraft/d7db265b53115d52a4ca5bffe5e9c6e4 CVE-2025-44557 - https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Cypress/Auth_bypass.md +CVE-2025-44559 - https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Realtek/Cross-layer_Interaction_Deadlock.md CVE-2025-4456 - https://github.com/3507998897/myCVE/issues/7 CVE-2025-4457 - https://github.com/3507998897/myCVE/issues/8 CVE-2025-4458 - https://github.com/ABC-YOLO/cve/blob/main/cve2.md @@ -119966,6 +119983,7 @@ CVE-2025-5299 - https://github.com/RS7325/cve/issues/3 CVE-2025-52991 - https://labs.snyk.io CVE-2025-52992 - https://labs.snyk.io CVE-2025-52993 - https://labs.snyk.io +CVE-2025-5301 - http://seclists.org/fulldisclosure/2025/Jun/18 CVE-2025-5301 - https://r.sec-consult.com/onlyoffice CVE-2025-5301 - https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/ CVE-2025-53021 - https://rentry.co/moodle-oauth2-cve @@ -120250,6 +120268,7 @@ CVE-2025-6018 - https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt CVE-2025-6019 - https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt CVE-2025-6019 - https://news.ycombinator.com/item?id=44325861 CVE-2025-6020 - http://www.openwall.com/lists/oss-security/2025/06/17/1 +CVE-2025-6105 - https://vuldb.com/?id.312574 CVE-2025-6121 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content CVE-2025-6121 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content#poc CVE-2025-6137 - https://candle-throne-f75.notion.site/TOTOLINK-T10-setWiFiScheduleCfg-20ddf0aa11858053a171f052787c202f