CVE-2022-27251

CVE-2022-27251 تنفيذ التعليمات البرمجية عن بُعد في LocalStack 0.12.6 بسبب عدم تعقيم مدخلات المستخدم في حقل معالج Lambda API أثناء إنشاء دوال Lambda، والطريقة غير الآمنة التي تُنشأ بها حاويات Docker، يمكن حقن أمر عبر AWS CLI في خيار --handler ليتم تنفيذه بواسطة عملية root أثناء إنشاء وتشغيل حاويات...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431

The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2024-32002

CVE-2024-32002 CVE-2024-32002 का शोषण करने के लिए छोटी स्क्रिप्ट, उपलब्ध CVE पर आधारित कैसे करें पहले, github या gitlab पर 2 खाली रेपो बनाएं। फिर git clone करें और यह स्क्रिप्ट चलाएं। अंत में: git clone –recursive repo2 स्वचालित RCE के लिए...

CVE-2026-74851

The Pods WordPress plugin before 3.3.9.1 contains a flaw in how it compares a display callback against its list of blocked functions, enabling users with the author role or above to achieve remote code execution on the server. The vulnerability only affects sites using the restricted display-call...

CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2025-68613

CVE-2025-68613 — n8n कामप्रवाह स्वचालन अभिव्यक्ति इंजिन पृथक्करण विफलता लेखक इस शोध के दुरुपयोग या क्षति के लिए कोई जिम्मेदारी नहीं लेता है केवल शैक्षिक और रक्षात्मक उद्देश्यों के लिए प्रदान किया गया है विवरण इस रिपॉजिटरी में एक प्रयोगशाला-स्तरीय विश्लेषण और भेद्यता CVE-2025-68613 के लिए एक...

CVE-2026-58096

FreeBSD ppp(8) contains an out-of-bounds write in LcpDecodeConfig(), which failed to validate the length of received multilink endpoint discriminator options against the minimum required by RFC 1717 . A malicious PPP peer can trigger the bug with undersized options, potentially crashing ppp(8) or...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2026-80214

LibreNMS 's Virtualization Discovery module is susceptible to command line injection , allowing an authenticated admin user to execute arbitrary code on the host server. The CVSS 4.0 base score is 8.6 (HIGH) , reflecting network reachability with low attack complexity but requiring high privilege...

CVE-2026-80214 LibreNMS Virtualisation Discovery Module RCE

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

CVE-2023-41892_PoC

CVE-2023-41892 Craft CMS PoC Questa repository contiene script proof-of-concept e un lab locale Vulhub per riprodurre CVE-2023-41892, una vulnerabilità di esecuzione remota di codice che non richiede autenticazione in Craft CMS. Usa questo progetto solo in un lab locale autorizzato o su altri...

CVE-2022-22947

منسوخ من Original: https://github.com/whwlsfb/cve-2022-22947-godzilla-memshell https://github.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947...

CVE-2026-75363

Comfast CF-WR630AX v.2.7.0.2 is vulnerable to remote arbitrary code execution through the binaries /usr/bin/webmgnt and /cgi-bin/mbox-config , specifically via the timestr and display_n parameters. The underlying root cause is not further detailed in the provided documents. A public proof-of-conc...

EUVD-2026-66743

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...

EUVD-2026-66747

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...