Lucene search
+L

271557 matches found

CVE
CVE
added 2026/09/12 12:08 p.m.5 views

CVE-2026-90553

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader . The loader ignores the trust_remote_code parameter when loading remote processor classes, allowing an attacker to craft a malicious model with arbitrary code in processing_llava_onevision2....

8.5CVSS
SaveExploits0References2
BDU FSTEC
BDU FSTEC
added 2026/09/12 11:42 a.m.21 views

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system (CMS) like 1C-Bitrix. This feature allows unauthorized users to execute arbitrary code by enabling unlimited uploading of dangerous types of files.

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

6.4CVSS6AI score
SaveExploits0References2Affected Software1
BDU FSTEC
BDU FSTEC
added 2026/09/12 11:42 a.m.26 views

The vulnerability of the CodeScoring software development platform lies in its inability to eliminate special elements from the template creation mechanism, allowing attackers to execute arbitrary code.

The vulnerability of the CodeScoring software development platform lies in the lack of measures to neutralize special elements within the template creation mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

9CVSS6.1AI score
SaveExploits0Affected Software1
BDU FSTEC
BDU FSTEC
added 2026/09/12 11:42 a.m.21 views

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system, which stems from the lack of authentication for a critical function, allows attackers to execute arbitrary code.

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

8.5CVSS6.2AI score
SaveExploits0Affected Software1
BDU FSTEC
BDU FSTEC
added 2026/09/12 11:42 a.m.23 views

The vulnerability of the VoIP gateway software Telecom MG, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the VoIP gateway software of Telecom MG is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

9CVSS6.2AI score
SaveExploits0Affected Software1
BDU FSTEC
BDU FSTEC
added 2026/09/12 11:41 a.m.68 views

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

10CVSS7AI score0.00412EPSS
SaveExploits0References11Affected Software9
NCSC
NCSC
added 2026/09/12 8:52 a.m.20 views

Vulnerabilities fixed in Cisco Secure Firewall Management Center

The vulnerability with reference CVE-2026-20079 is located in the web interface of Cisco Secure Firewall Management Center. An unauthenticated remote malicious party can bypass authentication controls by exploiting an incorrect system process created at startup. The malicious party can exploit th...

10CVSS6.4AI score0.75752EPSS
SaveExploits10References4
EUVD
EUVD
added 2026/09/12 7:39 a.m.5 views

EUVD-2026-76834

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

8.8CVSS0.00586EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/12 7:39 a.m.16 views

CVE-2026-78006

The Events Calendar WordPress plugin (versions ≤ 6.17.4 ) is vulnerable to unauthenticated Remote Code Execution via PHP Object Injection in the is_safe_widget_instance function. The root cause is a bypass of the unsafe-object guard: PHP magic methods fire during pre-parse, and enable_rendering_w...

9.8CVSS0.00778EPSS
SaveExploits1References7
CVE
CVE
added 2026/09/12 7:39 a.m.9 views

CVE-2026-78175

Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...

8.8CVSS0.00586EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/12 7:39 a.m.5 views

EUVD-2026-76833

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

9.8CVSS0.00762EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/12 7:39 a.m.5 views

EUVD-2026-76832

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

9.8CVSS0.00778EPSS
SaveExploits1References7
CVE
CVE
added 2026/09/12 7:39 a.m.18 views

CVE-2026-78159

The Events Calendar WordPress plugin (versions ≤ 6.17.3 ) is vulnerable to unauthenticated remote code execution via the Element_Classes::parse_array() function. Insufficient validation of the widget classes map allows a plain-array payload to bypass the is_safe_widget_instance() object check and...

9.8CVSS0.00762EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/12 6:33 a.m.7 views

CVE-2024-53677

CVE-2024-53677 - Apache Struts 2 远程代码执行漏洞(RCE)复现环境 该仓库提供了一个基于容器的环境,用于复现 Apache Struts 2 中的 CVE-2024-53677 漏洞。该漏洞涉及路径遍历,并允许通过 Struts 2 的文件上传功能执行任意代码(RCE)。 设置说明 该环境可以使用 Podman 构建和运行。请按照以下步骤来设置应用程序: root@kitploit: git clone https://github.com/seanrickerd/CVE-2024-53677.git cd CVE-2024-53677 podman...

9.8CVSS8.7AI score0.78198EPSS
SaveExploits15
Kitploit
Kitploit
added 2026/09/12 6:33 a.m.7 views

Zimbra-RCE

Zimbra-RCE Zimbra RCE(远程代码执行)CVE-2019-9670 root@kitploit: $ ./zimbra.py -h . . \ /|| \ | \ \ \ / / / | |/ | \ \ \ | / \ / | / / | | Y Y \ \ \ | // \ | | \ | \ / |||| / /| / || /\ / / / / / / / / / usage: zimbra.py -h -u URL -d DTD -n PAYLOADNAME -f PAYLOADFILE Zimbra RCE CVE-2019-9670...

9.8CVSS8.2AI score0.99986EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/12 6:32 a.m.7 views

jackson-CVE-2020-8840

CVE-2020-8840 FasterXML/jackson-databind Remote Code Execution Vulnerability...

9.8CVSS7.8AI score0.26587EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/12 6:28 a.m.7 views

dnschan

dnschan 这是一个运行在DNS上的木马。 你可以: 处理多个代理 (非常缓慢地)上传文件 从网络获取文件 运行进程...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 6:24 a.m.6 views

CVE-2015-1635-POC

CVE-2015-1635-POC MS15-034 HTTP.sys 远程执行代码检测脚本(MS15-034 HTTP.sys remote execution code poc script) 代码第7行处放置检测的IP,然后运行: python CVE-2015-1635-POC.py 将检测的IP放在代码第7行,然后运行: python CVE-2015-1635-POC.py...

10CVSS8.1AI score0.99999EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/12 6:22 a.m.6 views

microsoft-diagcab-rce-poc

microsoft-diagcab-rce-poc Proof of concept about a path traversal vulnerability in Microsoft's Diagcab technology that could lead to remote code execution You can find the full advisory here: https://medium.com/@radimre83/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 6:22 a.m.9 views

cve-2020-0618

CVE-2020-0618 蜜罐 检测并记录针对 CVE-2020-0618(SQL Reporting Services RCE)的利用尝试 像 SSRS 一样提供内容和头部信息,以增加在搜索引擎(例如 Google、Shodan 等)中被索引的机会 基于 MDSec 和 x1sec 的优秀工作 安装 获取代码 确保你有一个可用的 Go 环境。 root@kitploit: git clone https://github.com/wortell/cve-2020-0618 生成证书 生成自签名证书: root@kitploit: openssl genrsa -out...

9.8CVSS7.7AI score0.99022EPSS
SaveExploits14References1
Rows per page
Query Builder