cve-2025-53770-research

cve-2025-53770-research 🚨 Inteligencia de amenazas e investigación de respuesta a incidentes sobre el zero-day RCE "ToolShell" de SharePoint CVE-2025-53770. 🕵️‍♂️ Cubre fallas de deserialización de causa raíz, cronologías de ataque, métricas de riesgo y playbooks defensivos de validación de EDR. 🛡️...

cve-2019-13132-lab

CVE-2019-13132 — desbordamiento de pila en CURVE INITIATE de libzmq → laboratorio RCE Exploit RCE funcional de extremo a extremo + laboratorio reproducible para CVE-2019-13132 , un desbordamiento de búfer de pila en el manejador del handshake CURVE INITIATE de libzmq. Un atacante que conozca la...

CVE-2026-35196

CVE-2026-35196 · Chamilo LMS · Inyección de Comandos del SO → RCE Investigador: K Tipo de Divulgación: Divulgación Responsable Estado: Parcheado Producto Afectado: Chamilo LMS 2.0 Confirmado en v1.11.32 📋 Resumen de Vulnerabilidad...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

CVE-2026-76595

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...

CVE-2026-0770

CVE-2026-0770: Langflow execglobals Ejecución Remota de Código No Autenticada PoC CVE-2026-0770 es una vulnerabilidad de Ejecución Remota de Código RCE no autenticada que afecta a Langflow. El fallo se origina por una validación de entrada incorrecta en el manejo del parámetro execglobals...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE CVE-2021-44967 - Ejecución Remota de Código Autenticada Este repositorio contiene un exploit funcional para CVE-2021-44967 , una vulnerabilidad de Ejecución Remota de Código autenticada en LimeSurvey. 🎯 Compatibilidad Probado y confirmado funcionando en: LimeSurvey 5.2.x LimeSurv...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-77009

CVE-2026-77009 affects the WatchMan-Site7 WordPress plugin through version 4.2.0 . The plugin fails to restrict access to its debugging console , which executes user-supplied PHP code . Any authenticated user with a low privilege level (e.g., a subscriber ) can leverage this to achieve remote cod...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

EUVD-2026-70033

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting root@kitploit: python3 poc.py Example With debug set to False default root@kitploit: python3 poc.py...

CVE-2026-20841

The accuracy of this PoC trigger method has not been verified, and it should be considered informational/reference only. CVE-2026-20841 - Windows notepad.exe RCE Exploitation condition: Test on : Notepad Version 11.2510.14.0 step 1 : Save File step 2 : Open file Note: It does prompt to open progr...

CVE-2026-39987-Lab

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab Local-only Docker lab for reproducing and understanding CVE-2026-39987 in marimo. This project compares a vulnerable marimo service with a patched marimo service side-by-side, then demonstrates the difference using a least-harm proof...

WhatsRCE

WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? root@kitploit: sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRC...