CVE-2026-63030

LANGZ — Herramienta de Explotación wp2shell Autor: LANGZ CVE: CVE-2026-63030 Encadenado con CVE-2026-60137 Severidad: Crítica CVSS 9.8 Tipo: Ejecución Remota de Código Pre-Autenticación RCE ⚠️ Descargo de Responsabilidad Esta herramienta se proporciona estrictamente con fines educativos y para...

CVE-2026-63030-CVE-2026-60137

wp2shell PoC de RCE Pre-Auth - CVE-2026-63030 + CVE-2026-60137 WordPress 6.9.0–6.9.4 / 7.0.0–7.0.1 Solo para pruebas de penetración autorizadas e investigación de seguridad. Ejecutar esto contra sistemas sin autorización por escrito es ilegal. Los autores no aceptan ninguna responsabilidad por el...

Exploit for Improper Authentication in Openprinting Cups

CVE-2026-34990 — CUPS Local unprivileged user → root, via...

CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea diffpatch Git Hook RCE PoC ★ https://github.com/user-attachments/assets/403a70f4-4ff4-4ab7-b11c-d73d70adaf0b Descripción general CVE-2026-60004 es una vulnerabilidad de Ejecución Remota de Código RCE en Gitea. La API diffpatch aplica un...

Kestra-cve-2026-53576

RCE no autenticada en Kestra mediante un bypass de autenticación por ruta final CVE-2026-53576 Contenido Resumen ejecutivo 1. Resumen 2. Versiones afectadas / corregidas 3. Entorno de pruebas y verificación previa 4. Causa raíz 5. Simulación del ataque 6. Ingeniería de detección 7. Mapeo...

CVE-2026-43786

🔐 CVE-2026-43786 🚨 Escalada de Privilegios Local en macOS — Validación de Derechos Incorrecta 📌 Descripción General CVE-2026-43786 es una vulnerabilidad de escalada de privilegios local que afecta a macOS de Apple. La vulnerabilidad está relacionada con una validación incorrecta de derechos...

CVE-2026-57836-Confluent_Kafka

CVE-2026-57836: Verificación de certificados TLS deshabilitada para HashiCorp Vault KMS en confluent-kafka Severidad: Alta, CVSS 3.1 7.4 Vector v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Afectado: confluent-kafka = 2.8.0, = 2.14.2 Corregido en: 2.15.0 CWE: CWE-295 Validación de certificad...

badBANANA-threat-observatory

badBANANA // THREAT OBSERVATORY Inspect exploited vulnerabilities and threat indicators, check their source evidence, and review retained changes. Open the live Observatory · Try the KEV walkthrough · Source coverage · Run it yourself The Observatory brings CISA KEV, ThreatFox, URLhaus, and...

CVE-2026-20079-checker

CVE-2026-20079 Cisco FMC Read-Only Checker Una pequeña utilidad de validación deliberadamente limitada para CVE-2026-20079 , la vulnerabilidad de omisión de autenticación de Cisco Secure Firewall Management Center FMC. Este repositorio es un verificador, no un exploit. No contiene las partes de...

CVE-2020-13935

Exploit para la vulnerabilidad de WebSocket en Apache Tomcat CVE-2020-13935 En la entrada del blog correspondiente se explica en detalle el análisis y la explotación de la vulnerabilidad. Uso Clona el repositorio y, a continuación, compila el binario tcdos. Ejecuta el programa de la siguiente...

CVE-2026-100893

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

CVE-2026-100897

A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of the file /StudentInfo/StudentHandler/moditypasswordstu of the component Password Change Endpoint. Such manipulation of the argument sid/ti...

CVE-2025-14783-POC

🧨 CVE-2025-14783: Easy Digital Downloads Account Takeover PoC "Trust is the most exploitable security flaw." 💀 Description This repository contains a functional Proof of Concept PoC for CVE-2025-14783 , a critical Password Reset Poisoning vulnerability in the Easy Digital Downloads EDD plugin for...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Publicado : 26 de junio de 2026 Última actualización : 27 de junio de 2026 Investigador : Netwurm - VTDR e.V.i.G. Descripción de la Vulnerabilidad El plugin WP Full Stripe Free para WordPress es vulnerable a Autorización Faltante en versiones hasta, e...

CVE-2024-50945

CVE-2024-50945 Description SimplCommerce is affected by a Broken Access Control vulnerability in the review system, allowing unauthorized users to post reviews for products they have not purchased. Detection Method An attacker can detect this vulnerability by sending a request to the review...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

LoLLMS WebUI < 9.8 - Path Traversal

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /listpersonalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter. id: CVE-2024-4322 info: name: LoLLMS WebUI 9.8 - Path Traversal...

Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery

The Ray Dashboard API is affected by a Server-Side Request Forgery SSRF vulnerability in the url parameter of the /logproxy API endpoint. The API does not perform sufficient input validation within the affected parameter and any HTTP or HTTPS URLs are accepted as valid. id: CVE-2023-48023 info:...

GL.iNET SSID Key Disclosure

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. id: CVE-2023-31478 info: name: GL.iNET SSID Key Disclosure author: DhiyaneshDK severity: high description: | An issue was discovered on GL.iNet...