Joshua Provoste

10 exploits Active since Apr 2024
CVE-2026-2472 GITHUB HIGH python WORKING POC
Google Cloud Vertex AI SDK 1.98.0-1.131.0 - XSS
Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.
10 stars
CVE-2025-22870 NOMISEC MEDIUM WORKING POC
golang.org/x/net < 0.36.0 and Go net/http < 1.23.7/1.24.0-1.24.1 - Proxy Bypass via IPv6 Zone ID Misinterpretation
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
2 stars
CVSS 4.4
CVE-2024-9932 NOMISEC CRITICAL WORKING POC
Wux Blog Editor <3.0.0 - File Upload
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
2 stars
CVSS 9.8
CVE-2024-51793 NOMISEC CRITICAL WORKING POC
Webful Creations Computer Repair Shop <3.8115 - RCE
Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Upload a Web Shell to a Web Server.This issue affects RepairBuddy: from n/a through <= 3.8115.
1 stars
CVSS 10.0
CVE-2024-51791 NOMISEC CRITICAL WORKING POC
Made I.T. Forms <= 2.8.0 - Unauthenticated Arbitrary File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through <= 2.8.0.
1 stars
CVSS 10.0
CVE-2024-50498 NOMISEC CRITICAL WORKING POC
WP Query Console <= 1.0 - Remote Code Execution
Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.
1 stars
CVSS 10.0
CVE-2024-50526 NOMISEC CRITICAL WORKING POC
Multi Purpose Mail Form <= 1.0.2 - Unauthenticated Arbitrary File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
1 stars
CVSS 10.0
CVE-2023-51409 NOMISEC CRITICAL WORKING POC
Jordy Meow AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.
1 stars
CVSS 10.0
CVE-2026-2472 GITHUB HIGH python WORKING POC
Google Cloud Vertex AI SDK 1.98.0-1.131.0 - XSS
Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.
CVE-2026-2472 NOMISEC HIGH WORKING POC
Google Cloud Vertex AI SDK 1.98.0-1.131.0 - XSS
Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.