CVE-2025-55182
Author: trilogy-group
None
GitHub Link:
https://github.com/trilogy-group/react2shell-scan
Author: trilogy-group
None
GitHub Link:
https://github.com/trilogy-group/react2shell-scan
CVE-2013-0156.zip
2.3 KB
CVE-2013-0156
Author: 7s26simon
activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Link:
https://github.com/7s26simon/CVE-2013-0156
Author: 7s26simon
activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Link:
https://github.com/7s26simon/CVE-2013-0156
CVE-2025-13780.zip
2 KB
CVE-2025-13780
Author: zeropwn
None
GitHub Link:
https://github.com/zeropwn/pgadmin4-9.10-CVE-2025-13780
Author: zeropwn
None
GitHub Link:
https://github.com/zeropwn/pgadmin4-9.10-CVE-2025-13780
CVE-2020-1938.zip
16.3 KB
CVE-2020-1938
Author: abrewer251
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web app...
Author: abrewer251
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web app...
CVE-2025-55182
Author: VolksRat71
None
GitHub Link:
https://github.com/VolksRat71/react2shellexploitvisualized
Author: VolksRat71
None
GitHub Link:
https://github.com/VolksRat71/react2shellexploitvisualized
CVE-2020-0014.zip
4.5 MB
CVE-2020-0014
Author: doudoudedi
It is possible for a malicious application to construct a TYPETOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520
GitHub Link:
https://github.com/doudoudedi/CVE-2020-0014Toast
Author: doudoudedi
It is possible for a malicious application to construct a TYPETOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520
GitHub Link:
https://github.com/doudoudedi/CVE-2020-0014Toast
CVE-2019-11043.zip
8.9 KB
CVE-2019-11043
Author: gon905332-jpg
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
GitHub Link:
https://github.com/gon905332-jpg/cve-2019-11043.py
Author: gon905332-jpg
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
GitHub Link:
https://github.com/gon905332-jpg/cve-2019-11043.py