269208 matches found
Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution
critical unauthenticated remote code execution RCE vulnerability affecting Citrix ADC NetScaler ADC and Citrix Gateway appliances configured as a Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy or AAA virtual server. Exploitation can lead to arbitrary code execution. id: CVE-2023-3519 info...
Roxy-WI < 6.1.1.0 - Remote Code Execution
Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. id: CVE-2022-31137 info: name: Roxy-WI 6.1.1.0 - Remote Code Execution author:...
Apache OFBiz - Remote Code Execution
Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45507 info: name: Apache OFBiz -...
Apache Tomcat Path Equivalence - Remote Code Execution
Path Equivalence- 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. id: CVE-2025-24813 info: name: Apache Tomcat Path Equivalence - Remote Code Execution...
Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
Drupal - Remote Code Execution
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. id: CVE-2018-7600 info: name: Drupal - Remote Code Execution author:...
Apache Solr <=8.8.1 - Server-Side Request Forgery
Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...
Control Web Panel (CWP) - File Inclusion
In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...
WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...
NETGEAR Routers - Remote Code Execution
NETGEAR routers R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly others allow...
D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution
man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...
XWiki < 4.10.20 - Remote code execution
XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...
Burp_CVE-2025-31324
Extensão Burp Suite CVE-2025-31324 Visão Geral Esta extensão do Burp Suite baseada em Python foi projetada para detectar a presença da CVE-2025-31324 , uma vulnerabilidade crítica no componente Metadata Uploader do SAP NetWeaver Visual Composer. A vulnerabilidade permite a execução remota de códi...
gstreamer1-plugins-good security update
An update is available for gstreamer1-plugins-good. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...
Zoneminder
ADVISORY SUMMARY Successful exploitation of this vulnerability could result in full Remote Code Execution RCE as the web server user. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...
CVE-2024-37032
CVE-2024-37032 Path traversal in Ollama con server di registro malintenzionato Scopri di più su Probllama: vulnerabilità di esecuzione remota di codice in Ollama CVE-2024-37032 – Panoramica e mitigazioni Ambiente di vulnerabilità root@kitploit: docker run -d -v ollama:/root/.ollama -p 11434:11434...
cve-2024-27130-poc
CVE-2024-27130-poc CVE-2024-27130 ist eine schwerwiegende Sicherheitslücke, die QNAP Network Attached Storage NAS-Geräte betrifft. Die Schwachstelle beruht auf der unsicheren Verwendung der strcpy-Funktion in der Funktion NoSupportACL des share.cgi-Skripts im QTS-Betriebssystem, was zu einem...
cve-2019-6250-lab
CVE-2019-6250 — laboratorio RCE pre-autenticazione libzmq Catena RCE funzionante end-to-end + laboratorio riproducibile per CVE-2019-6250 , l'heap-buffer-overflow pre-autenticazione in libzmq's v2decodert::sizeready. Un overflow aritmetico di puntatore uint64t consente a un peer non autenticato d...
cve-2019-13132-lab
CVE-2019-13132 — libzmq CURVE INITIATE स्टैक ओवरफ़्लो → RCE लैब CVE-2019-13132 के लिए पूर्ण-अंत तक काम करने वाला RCE एक्सप्लॉइट + पुनरुत्पादन योग्य लैब, जो libzmq के CURVE INITIATE हैंडशेक हैंडलर में स्टैक बफ़र ओवरफ़्लो है। एक हमलावर जो सर्वर की दीर्घकालिक सार्वजनिक कुंजी जो डिज़ाइन के अनुसार एक...