CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431

The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...

CVE-2024-32002

CVE-2024-32002 CVE-2024-32002 का शोषण करने के लिए छोटी स्क्रिप्ट, उपलब्ध CVE पर आधारित कैसे करें पहले, github या gitlab पर 2 खाली रेपो बनाएं। फिर git clone करें और यह स्क्रिप्ट चलाएं। अंत में: git clone –recursive repo2 स्वचालित RCE के लिए...

CVE-2026-74851

The Pods WordPress plugin before 3.3.9.1 contains a flaw in how it compares a display callback against its list of blocked functions, enabling users with the author role or above to achieve remote code execution on the server. The vulnerability only affects sites using the restricted display-call...

CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2021-46703

CVE-2021-46703 सरल पेलोड निर्माता POC पर आधारित: https://github.com/Antaris/RazorEngine/issues/585 उपयोग C root@kitploit: dotnet build --configuration Release .\bin\Release\net4.8\Poc.exe "System.IO.File.WriteAllText"rce.txt", "Hello World";" Python root@kitploit: ./poc.py...

Apache-OFBiz-Exploit

Apache-OFBiz-Exploit Apache OFBiz CVE-2024-38856 के लिए Exploit द्वारा: Alisson Faoli Description इस रिपॉजिटरी में Apache OFBiz में पाई गई CVE-2024-38856 कमजोरी के लिए एक exploit है। यह दोष बिना प्रमाणीकरण के RCE Remote Code Execution की अनुमति देता है। नोट: यह exploit केवल शैक्षिक और अनुसंधान...

CVE-2025-25257

🚨 CVE-2025-25257 – FortiWeb SQLi से RCE महत्वपूर्ण SQL इंजेक्शन → वेबशेल निष्पादन 0xgh057r3c0n द्वारा खोजा और शस्त्रीकृत किया गया 🧠 कमज़ोरी अवलोकन CVE-2025-25257 FortiWeb सिस्टम को प्रभावित करता है जो /api/fabric/device/status एंडपॉइंट को उजागर करता है, जो Authorization हेडर इनपुट को ठीक से...

CVE-2025-68613

CVE-2025-68613 — n8n कामप्रवाह स्वचालन अभिव्यक्ति इंजिन पृथक्करण विफलता लेखक इस शोध के दुरुपयोग या क्षति के लिए कोई जिम्मेदारी नहीं लेता है केवल शैक्षिक और रक्षात्मक उद्देश्यों के लिए प्रदान किया गया है विवरण इस रिपॉजिटरी में एक प्रयोगशाला-स्तरीय विश्लेषण और भेद्यता CVE-2025-68613 के लिए एक...

CVE-2026-58096

FreeBSD ppp(8) contains an out-of-bounds write in LcpDecodeConfig(), which failed to validate the length of received multilink endpoint discriminator options against the minimum required by RFC 1717 . A malicious PPP peer can trigger the bug with undersized options, potentially crashing ppp(8) or...

CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – Hook di installazione di pacchetti PyPI dannosi esecuzione di setup.py Codice del programma Python root@kitploit: setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — im Zusammenhang mit der Verbreitung von WannaCry Für diese Übung bestand das Ziel darin, eine weitere bekannte reale Schwachstelle zu triagieren, diesmal EternalBlue, den SMBv1-Fehler, der bekanntermaßen beim WannaCry-Ransomware-Ausbruch ausgenutzt wurd...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

QNAP Photo Station < 6.0.3 - Remote Code Execution

QNAP Photo Station versions prior to 6.0.3 contain multiple vulnerabilities that, when chained together, enable unauthenticated remote code execution RCE. id: CVE-2019-7194 info: name: QNAP Photo Station 6.0.3 - Remote Code Execution author: x-stp severity: critical description: | QNAP Photo...

VMware vRealize Log Insight - Path Traversal

he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. id: CVE-2022-31706 info: name: VMware vRealize Log Insight - Path Traversal...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

VMware Aria Operations for Networks - Remote Code Execution

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. id:...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...