EUVD-2026-90916

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

CVE-2026-12540

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

CVE-2026-63292

A stack-based buffer overflow exists in mod_vhost_alias within the Apache Software Foundation Apache HTTP Server (versions through 2.4.68). An attacker can trigger this by sending an HTTP request with a Host header exceeding 8192 bytes, provided that VirtualDocumentRoot uses a hostname format spe...

EUVD-2026-90902

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require'node:node:test' and call run with attacker-controlled execArgv. node:test.run starts a...

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...

vulnerable-PDF

vulnerable-PDF = Salaries.pdf - develоpe mode: 08.10.2022 NOTE: This is only for testing and you can open just a calculator, the integrated program of Microsoft. = Or you can use the PDF file to download the calc.exe into a forbidden directory :D WARNING! Only for tests and education =...

CVE-2022-22963

CVE-2022-22963-Reverse-Shell-Exploit This is a Python script that exploits CVE-2022-22963, a remote code execution vulnerability in Spring Cloud Function that allows attackers to execute arbitrary code on a vulnerable server. The exploit uses the vulnerable /functionRouter endpoint to execute a...

CVE-2024-55182

CVE-2025-55182 React2Shell Vulnerablity 1. Explanation about the Vulnerablity: CVE-2025-55182 “React2Shell” is a critical Remote Code Execution RCE vulnerability inside React Server Components RSC — specifically in the React Flight protocol deserialization logic. Affects: React’s server-side...

Critical: Red Hat Security Advisory: Satellite 6.19.5 Async Update

A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

EUVD-2026-90854

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

CVE-2024-28715

CVE-2024-28715 CVE ID CVE-2024-28715 PRODUCT DoraCMS Version DoraCMS v2.18 and before PROBLEM TYPE Dom-based XSS. DESCRIPTION Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the...

CVE-2024-46538

Thanks tophysicszq, who discovered this vulnerability. CVE-2024-46538 ★ CVE-2024-46538 PfSense Stored XSS lead to Arbitrary Code Execution PoC ★ Description CVE-2024-46538 : PfSense Stored XSS Vulnerability description: A cross-site scripting XSS vulnerability in pfsense v2.5.2 allows attackers t...

CVE-2025-4322-Exploit

CVE-2025-4322 - Unverified Password Change CWE-620 Exploit: Download here Details CVE ID : CVE-2025-4322 Published : 05/20/2025 Impact : Critical CVSS : 9.8 Patch Available: No official patch yet Impact Critical severity vulnerability that enables attackers to potentially: - Escape the browser's...

CVE-2025-55182-React2Shell-RCE

CVE-2025-55182 - React2Shell Unauthenticated RCE in React Server Components CVE-2025-55182, also known as React2Shell , is a critical unauthenticated Remote Code Execution RCE vulnerability affecting React Server Components packages versions 19.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability ma...

CVE-2023-25136

CVE-2023-25136 OpenSSH 9.1 Vulnerability Mass Scanning and Exploitation Vulnerability Details OpenSSH is software that implements the SSH protocol, commonly used to securely connect to Linux or Windows machines for remote administration. The CVE-2023-25136 security vulnerability introduced in...

clone_and_pwn

Headers Exploit Title: Clone and Pwn Date: June 4th, 2018 Exploit Author: Alejandro Caceres Vendor Homepage: https://git-scm.com/ Software Link: https://git-scm.com/downloads Version: arbitrary code is executed on git client versions In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15....

CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall Discoverer : Golden Ticket Labs Vendor : Unitech pm2 Date Assigned : August 20, 2025 MITRE Description An issue in the lib/API/Modules/NPM.js component of Unitech PM2 v5.4.2 allows arbitrary code execution by installing packages with...

FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway

A flaw was found in FreeRDP. FreeRDP clients using TS Gateway are vulnerable to a heap-buffer-overflow. A malicious gateway can send a specially crafted response fragment, causing the client to write beyond its allocated buffer. This can lead to a client crash, resulting in a Denial of Service Do...

CVE-2025-2783

Chromium CVE-2025-2783: Sandbox Escape & Full-Chain RCE Exploit This repository contains a full-chain exploit implementation for CVE-2025-2783. The vulnerability resides in Chromium's Ipcz communication layer, allowing an attacker to achieve sandbox escape and arbitrary code execution from a...