CVE-2026-78103

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

DEBIAN-CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post Version 1.1.9 - SQL Injection I. Überblick 1. Was ist WordPress? WordPress ist ein Open-Source-CMS Content Management System, ein System zur Verwaltung von Inhalten. Anstatt HTML-Code zu verwenden, wird WP in der Programmiersprache PHP geschrieben...

CVE-2025-65345

CVE-2025-65345 – Authentifizierter Path Traversal über die ZIP-Funktion, der zur Offenlegung des Dateisystems in laravel-file-manager v3.3.1 führt 🧭 Übersicht Eine authentifizierte Directory-Traversal-Schwachstelle in laravel-file-manager v3.3.1 und früheren Versionen ermöglicht es Angreifern mit...

RCE-CVE-2025-3248

Esecuzione di codice remoto autenticata CVE-2025-3248 Langflow Questo script Python sfrutta CVE-2025-3248 per eseguire comandi arbitrari o avviare una reverse shell su un sistema vulnerabile. L'autenticazione è richiesta per utilizzare questo exploit. Caratteristiche Esecuzione di comandi...

-CVE-2025-59528-PoC

CVE-2025-59528-PoC NUR ZU BILDUNGSZWECKEN Ein einfaches Python-Skript zur Ausnutzung von CVE-2025-59528, einer authentifizierten RCE-Schwachstelle in der Flowise-Anwendung, einem beliebten KI-Tool, die auch Teil einer HTB-Saison-Challenge ist, auf der ich es übrigens getestet habe. Falls es nicht...

cve-2021-31630

cve-2021-31630 OpenPLC WebServer v3 - RCE Autenticato Questo script PoC si basa sull'exploit fornito da Fellipe Oliveira. Caratteristiche : Carica direttamente codice C in /hardware invece del caricamento file st Ripristina il programma predefinito prima di caricare la reverse shell Reverse shell...

CVE-2025-57055

CVE-2025-57055: تنفيذ التعليمات البرمجية عن بُعد بعد المصادقة في WonderCMS 3.5.0 آلية الثغرة توجد ثغرة تنفيذ تعليمات برمجية عن بُعد RCE بعد المصادقة في WonderCMS الإصدار 3.5.0. تنبع المشكلة من كيفية تعامل التطبيق مع التثبيت عن بُعد للسمات/الوحدات عبر ملفات وصف JSON. عندما يرسل مسؤول ملف JSON عن...

CVE-2020-8816

CVE 2020-8816 : Pi-hole versioni = 4.3.2 è affetto da una vulnerabilità di Remote Code Execution. Un utente autenticato del portale Web può eseguire comandi arbitrari sul server sottostante con i privilegi dell'utente locale che esegue il servizio. ESEMPIO : go run CVE-2020-8816.go -host $LHOST -...

CVE-2019-10945----Python3

CVE-2019-10945----Python3 Joomla! Core 1.5.0 - 3.9.4 - Directory Traversal / Eliminazione arbitraria di file autenticata...

EUVD-2026-67305

A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon iked, resulting in a denial of service, by saving a specially crafted configuration...

EUVD-2026-67292

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-36239

CVE-2026-36239 CVE-2026-36239: RCE autenticado no backend do PbootCMS v3.2.12 sitecopyright Visão Geral da Vulnerabilidade: Foi identificada uma vulnerabilidade crítica de execução remota de código RCE na funcionalidade sitecopyright da interface de administração do PbootCMS. Especificamente, a...

CVE-2023-40028

CVE-2023-40028: Sfruttamento di Symlink in Ghost CMS PoC Panoramica Questo repository contiene uno script Proof-of-Concept PoC progettato per dimostrare lo sfruttamento della CVE-2023-40028 , una vulnerabilità di Local File Inclusion LFI che colpisce Ghost CMS versioni precedenti alla 5.59.1. La...

CVE-2022-48311

CVE-2022-48311 Vulnerabilità di Cross Site Scripting XSS nella pagina di configurazione HTTP della stampante HP Deskjet 2540 serie con versione firmware CEP1FN1418BR e numero modello prodotto A9U23B Descrizione Cross Site Scripting XSS nella stampante HP Deskjet 2540 serie con versione firmware...

CVE-2020-26733

CVE-2020-26733 SKYWORTH GN542VF Hardware-Version 2.0 und Software-Version 2.0.0.16 Cross-Site-Scripting XSS-Schwachstelle Beschreibung Cross-Site-Scripting XSS auf der Konfigurationsseite in SKYWORTH GN542VF Hardware-Version 2.0 und Software-Version 2.0.0.16 ermöglicht es einem authentifizierten...

CVE-2026-81851

A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon iked, resulting in a denial of service, by saving a specially crafted configuration...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

cve-2019-3398

cve-2019-3398 Dettagli Una rapida proof of concept in Python per la vulnerabilità CVE-2019-3398 di Confluence, scritta in Python. Le versioni di Confluence 6.12.3, 6.13.3, 6.14.2 e 6.15.1 sono interessate. L'exploit richiede credenziali funzionanti. Come usare Modifica i campi osusername e...