Every new exploit,
on the radar.

Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

ScottCart <= 1.1 - Unauthenticated Remote Code Execution

WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

WordPress SoJ SoundSlides Plugin <= 1.2.2 is vulnerable to Arbitrary File Upload

Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update

CVE-2024-0406 POC using symlinks

vulnerable web app CVE-2024-0406 go cve

BTCPayServer version 1.7.5 and below is vulnerable for Open Redirection attack.

PoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)

Horde IMP (through 6.2.27) vulnerability – obfuscation via HTML encoding – XSS payload

SQL Server Reporting Services(CVE-2020-0618)中的RCE

CVE-2020-0618 Honeypot

Melissa

Exploit

PoC

TeamViewer User to Kernel Elevation of Privilege PoC. CVE-2024-7479 and CVE-2024-7481. ZDI-24-1289 and ZDI-24-1290. TV-2024-1006.

Proof of concept for CVE-2024-7479

Unauthorized Arbitrary File Download in WordPress WP01

Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Scrip…

A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. For educational use in …

Writeup and POC for CVE-2022-23134