Rahul Sreenivasan (Tr0j4n)

47 exploits Active since Mar 2025
CVE-2026-21510 GITHUB HIGH python WORKING POC
Microsoft Windows Shell - Protection Mechanism Failure
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
10 stars
CVSS 8.8
CVE-2026-21531 GITHUB CRITICAL python WORKING POC
Azure Conversation Authoring Client Library - Remote Code Execution via Untrusted Data Deserialization
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
10 stars
CVSS 9.8
CVE-2026-2248 GITHUB CRITICAL python WORKING POC
METIS WIC <= oscore 2.1.234-r18 - RCE
METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID 0) privileges. This results in full system compromise, allowing unauthorized access to modify system configuration, read sensitive data, or disrupt device operations
10 stars
CVSS 9.8
CVE-2026-24135 GITHUB HIGH python WORKING POC
Gogs < 0.13.4 - Authenticated Path Traversal via Wiki Update old_title Parameter
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.
10 stars
CVSS 8.1
CVE-2026-24854 GITHUB HIGH python WORKING POC
ChurchCRM < 6.7.2 - Authenticated SQL Injection via PaddleNumEditor.php PerID Parameter
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the `PerID` parameter. Version 6.7.2 contains a patch for the issue.
10 stars
CVSS 8.8
CVE-2026-25050 GITHUB MEDIUM python WORKING POC
Vendure < 3.5.3 - Timing Attack Enumerating Valid Usernames via NativeAuthenticationStrategy
Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found. The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts. Version 3.5.3 fixes the issue.
10 stars
CVSS 5.3
CVE-2026-25053 GITHUB CRITICAL python WORKING POC
n8n < 1.123.10 and 2.0.0-2.5.0 - Authenticated OS Command Injection and Arbitrary File Read via Git Node
n8n is an open source workflow automation platform. Prior to versions 1.123.10 and 2.5.0, vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. This issue has been patched in versions 1.123.10 and 2.5.0.
10 stars
CVSS 9.9
CVE-2026-25126 GITHUB HIGH python WORKING POC
PolarLearn <0-PRERELEASE-15 - Info Disclosure
PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value without runtime validation. TypeScript types are not enforced at runtime, so an attacker can send arbitrary strings (e.g., `"x"`) as `direction`. Downstream (`VoteServer`) treats any non-`"up"` and non-`null` value as a downvote and persists the invalid value in `votes_data`. This can be exploited to bypass intended business logic. Version 0-PRERELEASE-15 fixes the vulnerability.
10 stars
CVSS 7.1
CVE-2026-25130 GITHUB CRITICAL python WORKING POC
CAI Framework <= 0.5.10 - Remote Code Execution via Argument Injection in find_file Tool
Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell commands via `subprocess.Popen()` with `shell=True`, allowing attackers to execute arbitrary commands on the host system. The `find_file()` tool executes without requiring user approval because find is considered a "safe" pre-approved command. This means an attacker can achieve Remote Code Execution (RCE) by injecting malicious arguments (like -exec) into the args parameter, completely bypassing any human-in-the-loop safety mechanisms. Commit e22a1220f764e2d7cf9da6d6144926f53ca01cde contains a fix.
10 stars
CVSS 9.6
CVE-2026-25211 GITHUB LOW python WORKING POC
llama-stack < 0.4.0rc3 - Sensitive Information Exposure in Initialization Log
Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.
10 stars
CVSS 3.2
CVE-2026-25512 GITHUB HIGH python WORKING POC
Group-Office < 6.8.150 - Authenticated Remote Code Execution via tmp_file Parameter
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, there is a remote code execution (RCE) vulnerability in Group-Office. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.
10 stars
CVSS 8.8
CVE-2026-25643 GITHUB CRITICAL python WORKING POC
Frigate < 0.16.4 - Remote Command Execution via go2rtc exec Directive
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
10 stars
CVSS 9.1
CVE-2026-25807 GITHUB HIGH python WORKING POC
taklaxbr/zai_shell < 9.0.3 - Unauthenticated Remote Code Execution via P2P Terminal Sharing
ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user's privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3.
10 stars
CVSS 8.8
CVE-2026-25857 GITHUB HIGH python WORKING POC
Tenda G300-F <16.01.14.2 - Command Injection
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.
10 stars
CVSS 8.8
CVE-2026-25916 GITHUB MEDIUM python WORKING POC
Roundcube Webmail <1.5.13 & <1.6.13 - XSS
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
10 stars
CVSS 4.3
CVE-2026-26012 GITHUB MEDIUM python WORKING POC
vaultwarden < 1.35.3 - Incorrect Authorization via Organization Ciphers Endpoint
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.
10 stars
CVSS 6.5
CVE-2026-26221 GITHUB CRITICAL python WORKING POC
Hyland OnBase - Unauthenticated RCE
Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g., TimerServiceAPI.rem and TimerServiceEvents.rem for Workflow) to trigger unsafe object unmarshalling, enabling arbitrary file read/write. By writing attacker-controlled content into web-accessible locations or chaining with other OnBase features, this can lead to remote code execution. The same primitive can be abused by supplying a UNC path to coerce outbound NTLM authentication (SMB coercion) to an attacker-controlled host.
10 stars
CVSS 9.8
CVE-2026-26717 GITHUB MEDIUM python WORKING POC
Richie < 3.3.0 - Observable Timing Discrepancy in HMAC Signature Verification
An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies
10 stars
CVSS 4.8
CVE-2026-26988 GITHUB CRITICAL python WORKING POC
LibreNMS < 26.2.0 - SQL Injection via IPv6 Address Search in ajax_table.php
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.
10 stars
CVSS 9.1
CVE-2026-27639 GITHUB MEDIUM python WORKING POC
Mercator < 2026.02.22 - Authenticated Stored Cross-Site Scripting via Unescaped Blade Directives
Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Mercator prior to version 2026.02.22 due to the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject arbitrary JavaScript payloads into fields such as "contact point" when creating or editing entities. The payload is then executed in the browser of any user who views the affected page, including administrators. Version 2026.02.22 fixes the vulnerability.
10 stars
CVSS 5.4
CVE-2026-27831 GITHUB HIGH python WORKING POC
rldns 1.3 - Denial of Service via Heap-Based Out-of-Bounds Read
rldns is an open source DNS server. Version 1.3 has a heap-based out-of-bounds read that leads to denial of service. Version 1.4 contains a patch for the issue.
10 stars
CVSS 7.5
CVE-2025-10042 EXPLOITDB MEDIUM python WORKING POC
Quiz Maker < 6.7.0.56 - Unauthenticated SQL Injection via Spoofed IP Headers
The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable in configurations where the server is set up to retrieve the IP from a user-supplied field like `X-Forwarded-For` and limit users by IP is enabled.
CVSS 5.9