Every new exploit,
on the radar.

Integer Overflow in Cart Logic in SimplCommerce allows remote attackers to manipulate product quantities and total prices via crafted inputs that exploit insuf…

Radio Player <= 2.0.82 - Blind Unauthenticated Server-Side Request Forgery

Code Generator Pro <= 1.2 - Unauthenticated SQL Injection

Wr Age Verification <= 2.0.0 - Unauthenticated SQL Injection

Hurrakify <= 2.4 - Unauthenticated Server-Side Request Forgery

PoC for CVE-2024-53522 affecting HOSxP XE 4

[POC][Exploit] CVE-2024-10400

Restrict Content <= 3.2.7 - Information Exposure via legacy log file

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution

对NETIS WF2409E路由器进行的一次完整硬件安全分析研究。通过对设备进行拆解分析、调试接口识别、固件提取等工作，记录了硬件分析的全过程、漏洞细节以及相应的安全建议，希望能帮助提高物联网设备的安全性。

PoC of CVE-2023-21537

Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

CVE-2024-51442 write up and example config file

Precompiled lib3mf.dll for MeshMixer which includes a backported patch for CVE-2021-21772 and zlib 1.3.1

CVE-2024-54819

CVE-2024-55557

This repository contains exploits for iTOP CVE-2024-52002, 52000, 31998, 31448 that involve CSRF+XSS chaining to get RCE

An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file (DLL Hijacking)

CVE-2021-26690 patch diffing - Apache HTTP mod_session NULL pointer dereference

Crash PoC for exploiting Netskope Endpoint DLP double-fetch.

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check