CVE-2026-77138

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2023-46747-RCE

Dettagli sulla vulnerabilità fofa： root@kitploit: title="BIG-IP" || iconhash="-335242539" shodan root@kitploit: title:"BIG-IP" Versioni interessate https://my.f5.com/manage/s/article/K000137353 Riproduzione della vulnerabilità 1. Al momento, qui l'utente è solo admin: 2. Esegui lo script:...

CVE-2025-55182-realistic-poc

CVE-2025-55182: React Server Components RCE Ein minimaler Proof of Concept, der die kritische Remote-Code-Ausführungs-Sicherheitslücke in [email protected] demonstriert. Was ist CVE-2025-55182? Eine Pre-Authentication-RCE-Sicherheitslücke in React Server Components, die es Angreifern...

Log4j-RCE

Log4j-RCE Log4j RCE - CVE-2021-44228 طريقة التشغيل؟ root@kitploit: php log4j.php https://1337.com المتطلبات PHP CURL PAYLOAD DNS LOG Collaborator Burpsuite أو استخدم dnslog.cn قائمة الحمولات Payload root@kitploit: $ctx:loginId $map:type $filename $date:MM-dd-yyyy $docker:containerId...

cve-2019-6340-bits

cve-2019-6340-bits Bit generati durante l'analisi di CVE-2019-6340 Drupal RESTful RCE regola modsec pcap esempio di configurazione nginx log di esempio playbook di esempio...

CVE-2019-16278

Exploit per CVE-2019-16278 e CVE-2019-16279 Nostromo httpd è soggetto a 2 vulnerabilità critiche per versioni &1 Questo bug è dovuto a una correzione incompleta per CVE-2011-0751. Possiamo aggirare un controllo per che ci permette di eseguire con argomenti arbitrari...

PaperCut-Authentication_Bypass_and_RCE

CVE-2023-27350 — Bypass di Autenticazione e RCE su PaperCut NG/MF Exploit Python standalone per la vulnerabilità critica di bypass dell'autenticazione e esecuzione remota di codice in PaperCut NG/MF. CVSS 9.8. Descrizione CVE-2023-27350 colpisce PaperCut NG e MF nelle versioni precedenti a 20.1.7...

IPFire_2.25_RCE_Authenticated

IPFire 2.25 Remote Code Execution Authenticated - CVE-2021-33393 Questo exploit si basa su CVE-2021-33393 https://nvd.nist.gov/vuln/detail/CVE-2021-33393 ed è stato sviluppato a partire dall'exploit originale di Mücahit Saratar https://github.com/KaanaryOverFlow/ipfire-2-25-auth-rce, estendendolo...

Additive-Vulnerability-Analysis-CVE-2021-41773

Additive-Vulnerability-Analysis-CVE-2021-41773 Apache: un servizio Web mainstream trasformato in un vettore di attacco per esecuzione remota di codice...

cve-2019-1663

🚀 Exploitation von CVE-2019-1663 🧩 Einleitung Dieses Repository dokumentiert die Ausnutzung von CVE-2019-1663, einer kritischen Schwachstelle zur Remotecodeausführung RCE in den Cisco-Routern RV110W, RV130W und RV215W Wireless-N VPN. Aufgrund unzureichender Eingabevalidierung in der Weboberfläche...

CVE-2019-9193

EN GenPostgresRCEExploit è uno strumento PoC progettato per sfruttare una vulnerabilità autenticata di esecuzione remota del codice RCE in alcune versioni di PostgreSQL 9.3 - 11.7. Consente agli utenti autenticati di eseguire comandi di sistema su un server di database PostgreSQL vulnerabile a...

CVE-2024-0692-SolarWinds-SEM-RCE

CVE-2024-0692-SolarWinds-SEM-RCE ペネトレーションテスト中の私の研究に基づき、詳細はこちらをご覧ください https://www.sprocketsecurity.com/blog/cve-2024-0692-building-the-exploit-that-didnt-exist...

PoC_CVE-2025-55182

Next.js React2Shell CVE-2025-55182 Exploit-Tool Ein Proof-of-Concept-Tool zur Demonstration der kritischen React2Shell-Sicherheitslücke CVE-2025-55182 / CVE-2025-66478 in ausschließlich autorisierten, lokalen Testumgebungen. ⚠️ KRITISCHE WARNUNG: AKTIVE AUSBEUTUNG Diese Sicherheitslücke CVSS 10.0...

CVE-2023-22527

CVE-2023-22527 - Vulnerabilità RCE Remote Code Execution in Confluence Data Center e Confluence Server PoC Rilevamento nuclei -v -t /path/to/template.yam; -u http://ip:port/ Exploit python3 CVE-2023-22527.py -u ip:port -lh listen-host -lp listen-port...

CVE-2024-32002-Reverse-Shell

CVE-2024-32002-Reverse-Shell Questo script dimostra come sfruttare la vulnerabilità CVE-2024-32002 per ottenere una reverse shell, fornendo accesso remoto al sistema affetto. Usatelo con cautela in ambienti controllati e solo a scopo educativo o di test di sicurezza. Pubblicazione del Blog Questo...

CVE-2026-77136 Server-Side Template Injection in extension "powermail" (powermail)

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2026-77136

CVE-2026-77136 is a Server-Side Template Injection (SSTI) in the TYPO3 Powermail extension. The raw value of a form field configured as the sender_name field is passed directly into a Fluid View as template source without sanitization. An unauthenticated attacker can submit arbitrary Fluid templa...

EUVD-2026-65340

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...

CVE-2026-77138

CVE-2026-77138 affects the TYPO3 extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) . The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safe processing, enabling PHP Object Injection . A remote, unauthenticated attacker can supply a ...