Github Exploits

2,250 exploits tracked across all sources.

Sort: Activity Stars
CVE-2021-35344 GITHUB CRITICAL
tsMuxer <2.6.16 - Buffer Overflow
tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h.
by cemonatk
3 stars
CVSS 9.8
CVE-2021-34071 GITHUB MEDIUM
Tsmuxer - Out-of-Bounds Write
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
by cemonatk
3 stars
CVSS 5.5
CVE-2021-34070 GITHUB MEDIUM
Tsmuxer - Out-of-Bounds Read
Out-of-bounds Read in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
by cemonatk
3 stars
CVSS 5.5
CVE-2021-34069 GITHUB MEDIUM
Tsmuxer - Divide By Zero
Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
by cemonatk
3 stars
CVSS 5.5
CVE-2021-34068 GITHUB MEDIUM
Tsmuxer - Out-of-Bounds Write
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
by cemonatk
3 stars
CVSS 5.5
CVE-2021-34067 GITHUB MEDIUM
Tsmuxer - Out-of-Bounds Write
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
by cemonatk
3 stars
CVSS 5.5
CVE-2021-44957 GITHUB MEDIUM
Rockcarry Ffjpeg < 2021-01-01 - Buffer Overflow
Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in the jfif_encode function at ffjpeg/src/jfif.c (line 708) could cause a Denial of Service by using a crafted jpeg file.
by cemonatk
3 stars
CVSS 6.5
CVE-2021-44956 GITHUB MEDIUM
Rockcarry Ffjpeg < 2021-01-01 - Out-of-Bounds Write
Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfif_decode function at ffjpeg/src/jfif.c (line 552) could cause a Denial of Service by using a crafted jpeg file.
by cemonatk
3 stars
CVSS 6.5
CVE-2024-42010 GITHUB HIGH javascript
Roundcube <1.5.7, <1.6.0-1.6.7 - Info Disclosure
mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.
by victoni
2 stars
CVSS 7.5
CVE-2025-31161 GITHUB CRITICAL python
CrushFTP - Authentication Bypass
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
by ghostsec420
12 stars
CVSS 9.8
CVE-2024-21887 GITHUB CRITICAL python
Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
by Chocapikk
26 stars
CVSS 9.1
CVE-2025-24514 GITHUB HIGH python
K8s.io Ingress-nginx < 1.11.5 - Improper Input Validation
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
by lufeirider
9 stars
CVSS 8.8
CVE-2025-1974 GITHUB CRITICAL python
Kubernetes - RCE
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
by lufeirider
9 stars
CVSS 9.8
CVE-2025-1098 GITHUB HIGH python
Ingress-Nginx - RCE
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
by lufeirider
9 stars
CVSS 8.8
CVE-2024-37859 GITHUB MEDIUM
Oretnom23 Lost And Found Information System - XSS
Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php.
by Rezur0x7
CVSS 6.1
CVE-2024-37858 GITHUB CRITICAL
Oretnom23 Lost And Found Information System - SQL Injection
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php.
by Rezur0x7
CVSS 9.8
CVE-2024-37857 GITHUB HIGH
Oretnom23 Lost And Found Information System - SQL Injection
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php-lfis/admin/categories/view_category.php.
by Rezur0x7
CVSS 8.8
CVE-2024-37856 GITHUB MEDIUM
Oretnom23 Lost And Found Information System - XSS
Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, middle name fields in the User Profile page.
by Rezur0x7
CVSS 5.4
CVE-2025-2778 GITHUB python
Rejected
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
by watchtowrlabs
12 stars
CVE-2025-2777 GITHUB CRITICAL python
SysAid On-Prem <= 23.3.40 - XML External Entity
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
by watchtowrlabs
12 stars
CVSS 9.3
CVE-2025-2776 GITHUB CRITICAL python
SysAid On-Prem <= 23.3.40 - XML External Entity
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
by watchtowrlabs
12 stars
CVSS 9.3
CVE-2023-48292 GITHUB CRITICAL python
Xwiki Admin Tools < 4.5.1 - CSRF
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.
by Mehran-Seifalinia
2 stars
CVSS 9.6
CVE-2023-37979 GITHUB HIGH python
Ninjaforms Ninja Forms < 3.6.26 - XSS
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.
by Mehran-Seifalinia
2 stars
CVSS 7.1
CVE-2025-24514 GITHUB HIGH python
K8s.io Ingress-nginx < 1.11.5 - Improper Input Validation
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
by hakaioffsec
248 stars
CVSS 8.8
CVE-2025-1974 GITHUB CRITICAL python
Kubernetes - RCE
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
by hakaioffsec
248 stars
CVSS 9.8