CVE-2026-100857 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

CVE-2026-100857 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

CVE-2026-100857 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

EUVD-2026-87822

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration...

hexcymatix

hexcymatix hexcymatix is an exploratory research project, loosely envisioned as a binary reverse engineering tool for extracting structural information from repeated byte patterns in binary files. The idea never materialized into a usable tool, but still yields some fascinating representations of...

CVE-2021-41773

CVE-2021-41773 PoC — Apache HTTP Server Path Traversal Overview CVE-2021-41773 is a path traversal vulnerability affecting Apache HTTP Server 2.4.49. The vulnerability allows an attacker to access files outside the intended directory under specific configurations, particularly when directories ar...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Description A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM CVSS 10.0, allowing unauthenticat...

cve-2024-1708-connectwise_rce_reproduction

CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass & Remote Code Execution CVSS Score: 8.4 CVE-2024-1708 – 10.0 CVE-2024-1709 CWE: CWE-22 Path Traversal, CWE-288 Authentication Bypass Using an Alternate Path Affected Software: ConnectWise ScreenConnect formerly...

CVE-2026-67185-Unauthenticated-Path-Traversal-Allows-Arbitrary-File-Read-TinyWeb-

Security Advisory: Unauthenticated Path Traversal Allows Arbitrary File Read TinyWeb Assigned CVE ID: CVE-2026-67185 Summary TinyWeb builds the path of the file to serve by joining the web root with the request URL exactly as it arrives, with no normalization. A remote client that has never...

CVE-2024-4577-RCE-PoC

CVE-2024-4577 RCE Exploit While implementing PHP, the team did not notice the Best-Fit feature of encoding conversion within the Windows operating system. This oversight allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by specific character sequences. Arbitrary...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

ARES

Operator-Directed Red Team Orchestration & Continuous Security Validation Platform The open-core platform empowering enterprise red teams, MSSPs, and security operations centers to execute targeted offensive engagements, discover deterministic attack paths, and continuously validate defensive...

CVE-2021-41773

Apache 2.4.49 Path Traversal + Remote Code Execution CVE-2021-41773 Vulnerability Description This vulnerability affects versions of Apache HTTP Server 2.4.49. A path validation error allows remote attackers to perform Path Traversal using sequences like .%2e/ to access paths outside the configur...

By-Poloss..-..CVE-2026-39938

CVE-2026-39938: Cacti = 1.2.30 - Unauthenticated LFI Executive Summary Field| Value ---|--- CVE ID| CVE-2026-39938 CVSS Score| 9.8 Critical Affected Product| Cacti Affected Versions| = 1.2.30 Patched Version| 1.2.31 Fix Commit| 9871f0c Vulnerability Details Root Cause The vulnerability exists in...

BLACKHAT_USA2022

BLACKHATUSA2022 Just About BLACKHAT USA2022 PDF Public Download in release or this mirror File List, Search what your intersting. root@kitploit: ├── BLACKHATUSA2022 │ ├── Taking Kerberos To The Next Level.pdf │ ├── US-22-ABDELLATIF-Unlimited-Results-Breaking-Firmware-Encryption.pdf │ ├──...

reproducer-poc-CVE-2022-0847

Naive detector and reproducer of CVE-2022-0847 dirty pipe. Uses simple generator of syscall sequences / programs from purposefully limited set of building blocks / input values only generation, no advanced fuzzing; no mutation; no coverage guidance; no shrinking / minimization and detects...

CVE-2026-100706

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100638

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook...

CVE-2026-100636

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences...

CVE-2026-100637

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...