CVE-2025-5548

🛡️ Analisi e Sfruttamento: CVE-2025-5548 Master in Cybersecurity | Modulo 6: Vulnerabilità 👋 Ciao! Benvenuto al mio Laboratorio di Analisi In questo repository documento la mia immersione pratica nell'analisi delle vulnerabilità a livello binario e lo sviluppo di exploit per ambienti Windows...

CVE-2022-22965-Spring4Shell-Security-Operations-Analysis

CVE-2022-22965 — Spring4Shell Security Operations Analyse Eine praktische Simulation eines Security Operations Centre SOC, bei der ich die Rolle eines Information Security Analyst übernommen habe und auf einen aktiven Spring4Shell-Exploit-Versuch reagiert habe. Dieses Repository dokumentiert den...

EUVD-2026-37015

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads...

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...

CVE-2019-5420-RCE

Dieses Repository hat keine README-Datei...

CVE-2025-24813-Exploit

CVE-2025-24813-Exploit Exploit per l'esecuzione di codice remoto RCE in Apache Tomcat - CVE-2025-24813 🚀 Exploit RCE per Apache Tomcat - CVE-2025-24813 🔥 Strumento di Exploit e Rilevamento per Apache Tomcat RCE CVE-2025-24813 Questa repository contiene un exploit PoC Proof of Concept per la...

CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 ist eine kritische SQL-Injection-Schwachstelle vor der Authentifizierung, die die Fabric-Connector-Komponente von Fortinet FortiWeb betrifft. Sie betrifft die FortiWeb-Versionen: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 Technische Details Das Problem liegt in de...

CVE-2026-75496

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...

CVE-2022-39986-RaspAP-2.8.0-2.8.7-RCE

RaspAP Hunter RaspAP Hunter è uno script Bash progettato per scansionare installazioni RaspAP e testarle per una specifica vulnerabilità, la CVE-2022-39986. root@kitploit: / \ / | / \ / // // // // \ / /| | / // / / , // // / / // // | / / // || ,//// ./// ||// // author: mind2hex / / / / / / / /...

CVE-2016-5734-docker

CVE-2016-5734-docker PhpMyAdmin 4.0.x—4.6.2 Vulnerabilidade de Execução Remota de Código CVE-2016-5734 Configuração root@kitploit: git clone https://github.com/miko550/CVE-2016-5734-docker.git cd CVE-2016-5734-docker docker compose up hhtp://localhost:8083 Exploração root@kitploit: python3...

CVE-2023-32315

CVE-2023-32315 Openfire Console Authentifizierungs-Bypass-Schwachstelle mit RCE Plugin Einrichtung root@kitploit: git clone https://github.com/miko550/CVE-2023-32315.git cd CVE-2023-32315 pip3 install -r requirements.txt Verwendung root@kitploit: python3 CVE-2023-32315.py -t http://127.0.0.1:9090...

citrix_dir_traversal_rce

citrixdirtraversalrce Una directory traversal è stata scoperta in Citrix Application Delivery Controller ADC, noto anche come NetScaler, e Gateway 10.5, 11.1, 12.0, 12.1 e 13.0. Quando l'NSPPE riceve una richiesta per GET /vpn/index.html, dovrebbe inviarla ad Apache, che la elabora. Tuttavia,...

SuiteCRM-RCE

CVE-2020-28328 SuiteCRM Esecuzione di codice remoto tramite impostazione di sistema del file di log e avvelenamento del file di log Panoramica Recentemente ho scoperto due vulnerabilità in SuiteCRM che forniscono una catena di attacco per un utente con privilegi limitati per ottenere l'esecuzione...

WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability

Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...

UltraRealy_with_CVE-2019-1040

UltraRelay aggiornato da Lazaar Sami per l'exploit CVE-2019-1040 UltraRelay è uno strumento per l'avvelenamento LLMNR e il relay delle credenziali NTLM. Si basa su Responder e impack. Ho aggiornato la versione originale https://github.com/5alt/ultrarelay per l'exploit CVE-2019-1040. Dirk-jan...

CVE-2024-47176

PoC: Unauthenticated RCE auf cups-browsed 📜 Schwachstelleninformationen...

EUVD-2026-65585

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...

CVE-2026-75496

Webkul QloApps contains an improper file upload validation flaw. The application fails to properly validate uploaded file extensions or MIME types before moving the file to a publicly accessible directory . A remote, authenticated attacker with administrative privileges can exploit this by upload...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...