CVE-2022-21587-Oracle-EBS-

Prerequisiti per eseguire questo exploit: python3 con i moduli inclusi requests, os, sys, slipit uuencode Prima di eseguirlo, assicurati di usarlo solo per scopi etici Se l'esecuzione dell'exploit fallisce: Assicurati di aver già installato i moduli prerequisiti installa requests pip3 install...

CVE-2020-35846

Cockpit CMS NoSQL Injection to Esecuzione Remota di Codice : CVE-2020-35846 Descrizione Cockpit CMS presenta alcune vulnerabilità NoSQL che possono essere utilizzate per scaricare le informazioni degli utenti. Queste fughe di informazioni possono essere concatenate per modificare le password degl...

CVE-2026-62291

A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image formats. A remote attacker could exploit this vulnerability by providing a specially crafted image sequence with mismatched auxiliary alpha dimensions. During the image processing workflow, this could lead to...

exploit-CVE-2022-24780

iTop RCE via SSTI - CVE-2022-24780 Exploit iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

CVE-2022-36553-PoC

CVE-2022-36553 - Hytec Inter HWL-2511-SS Nicht authentifizierte Remote-Befehlseinschleusung. Übersicht Dieses Repository enthält ein Proof-of-Concept PoC Reverse-Shell-Skript zur Ausnutzung von CVE-2022-36553, einer kritischen Schwachstelle in Hytec Inter HWL-2511-SS-Geräten. Das Skript ist eine...

CVE-2026-76841

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-59568

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

ripple20-digi-connect-exploit

Ripple20 Exploit: Digi Connect ME 9210 Authors: Moshe Kol, Shlomi Oberman Questo repository contiene un exploit PoC per CVE-2020-11896, una critica vulnerabilità di buffer overflow basata su heap nello stack Track TCP/IP parte della suite di vulnerabilità Ripple20. L'exploit consente l'esecuzione...

CVE-2022-22909

CVE-2022-22909 Descrizione È stata trovata una vulnerabilità di Code Injection nell'applicazione Hotel Druid v3.0.3, che un attaccante potrebbe sfruttare per eseguire codice remoto sul server. Per uno sfruttamento riuscito, un attaccante deve avere il privilegio di aggiungere una nuova stanza...

CVE-2026-78367 Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-78367 Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-45698

A flaw was found in Netatalk. A stack-based buffer overflow in the deletedir function of the afpd daemon can be exploited by a remote attacker. This occurs due to an integer underflow during path construction, which allows attacker-controlled filenames to be copied into a stack buffer without...

CVE-2026-59568

CVE-2026-59568 covers multiple vulnerabilities in Zscaler Client Connector (ZCC) that allow an unauthenticated, unprivileged remote attacker to achieve remote code execution in the ZCC context. The CNA-assigned CVSS 3.1 score is 9.1 (CRITICAL) , with a network attack vector, low complexity, no pr...

CVE-2026-59568 Remote Code Execution

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

EUVD-2026-64884

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

cve-2025-63888-exploit

CVE-2025-63888 ThinkPHP 5.0.24 File Inclusion RCE Exploit Uno strumento di ricerca sulla sicurezza per rilevare e testare la vulnerabilità CVE-2025-63888 in ThinkPHP 5.0.24, che consente l'esecuzione remota di codice tramite attacchi di inclusione di file. ⚠️ Disclaimer Questo strumento è destinat...

CVE-2025-47812-poC

CVE-2025-47812-poC Wing FTP Server RCE CVE-2025-47812 के लिए सरल शोषण जो कमांड चलाने और रिवर्स शेल प्राप्त करने के लिए है। केवल शैक्षिक उपयोग के लिए। भेद्यता विवरण यह सुरक्षा भेद्यता RCESecurity https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ द्वारा सार्वजनिक...

Dubbo-deserialization

Apache Dubbo Deserialisierungs-Schwachstellenforschung Dieses Repository enthält Forschungsmaterialien, Proof-of-Concept-Code und Exploitation-Tools im Zusammenhang mit Deserialisierungs-Schwachstellen in Apache Dubbo, mit besonderem Fokus auf CVE-2020-1948. Repository-Struktur Verzeichnisse...

CVE-2021-4045

TP-Link Tapo c200 1.1.15 - Esecuzione di codice remoto RCE CVE-2021-4045 🔐 "PWNTAPO: Svelata l'iniezione di comandi nelle telecamere TP-Link Tapo C200 = v1.1.16 Build 211209" 🔓 Leggi l'exploit su exploit db Si tratta di una vulnerabilità di iniezione di comandi che colpisce tutte le versioni del...

EUVD-2026-64849

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...