CVE-2026-107459

The SecuShare Pro software, developed by Openfind , is susceptible to an OS Command Injection vulnerability (CWE-78 ). This flaw allows unauthenticated remote attackers to inject and execute arbitrary OS commands directly on the server. The vulnerability is classified as CRITICAL with a CVSS 3.1 ...

CVE-2025-11988

1 Extract the public cryptoajax nonce UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

Exploit for CVE-2026-21589

CVE-2026-21589 Atlassian DC Pre-Auth Arbitrary File Read,...

CVE-2026-106556

A flaw was found in the Backstage plugin-techdocs-node component. Insufficient validation of documentation configuration files during documentation generation allows sanitization checks to be bypassed. An authenticated user with permission to register or modify documentation sources can exploit...

CVE-2026-48778-PoC

CVE-2026-48778 — Notepad++ Arbitrary Code Execution PoC Severity: High CVSS 7.8 | Affected: Notepad++ ≤ 8.9.6 | Patched: v8.9.6.1 A PoC script for CVE-2026-48778, an arbitrary code execution vulnerability in Notepad++ ≤ 8.9.6. For full technical details, see the official security advisory. Usage...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2022-46364 , a Local File Inclusion LFI vulnerability in Apache CXF. The vulnerability arises due to improper handling of XOP XML-binary Optimized Packaging Include elements in SOAP...

CVE-2026-48800-PoC

CVE-2026-48800 — Notepad++ Arbitrary Code Execution PoC Severity: High | Affected: Notepad++ ≤ 8.9.6 | Patched: v8.9.6.1 A PoC script for CVE-2026-48800, an arbitrary code execution vulnerability in Notepad++ ≤ 8.9.6 via shortcuts.xml. For full technical details, see the official security advisor...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 A Python-based security tool to detect and exploit an arbitrary file read vulnerability in the WordPress WP File Upload plugin versions = 4.24.11...

CVE-2026-93372

A flaw was found in chromium-browser. A remote attacker can achieve arbitrary code execution outside the browser's security sandbox due to a buffer overflow in the Web Graphics Library WebGL component. An attacker can exploit this vulnerability by enticing a user to visit a specially crafted web...

CVE-2026-87662

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

CVE-2026-17609

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2016-16113-POC

Get RCE - Bludit CMS Exploit | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| An automated exploitation tool that combines CVE-2019-17240 Authentication Bypass and CVE-2019-16113 Arbitrary File Upload to achieve remote code execution on...

CVE-2025-29009-POC

CVE-2025-29009-POC Plugin de Adjunto de Recetas Médicas para WooCommerce = 1.2.3 - Carga Arbitraria de Archivos No Autenticada. Mira la demostración aquí: https://youtu.be/WvW2shDBIFs...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile Arbitrary File Write via Path Traversal CVE-2025-4517 CVSS 9.4 – Critical A vulnerability in Python's tarfile module that allows arbitrary file writes outside the extraction directory when using TarFile.extractall or TarFile.extract with filter="data" or...

CVE-2024-23334-PoC

CVE‑2024‑23334 Path Traversal - PoC I created this script to automate the exploitation of CVE‑2024‑23334 on the Hack The Box Chemistry machine. This vulnerability affects aiohttp versions ≥ 1.0.5 and 3.9.2 when the application is configured to serve static files with followsymlinks=True, allowing...

CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-17609

The Super Forms WordPress plugin (versions up to and including 6.3.316 ) is vulnerable to unauthenticated arbitrary directory deletion . The flaw exists in the submit_form function due to insufficient validation of attacker-controlled JSON field declarations against the form schema. Specifically,...

EUVD-2026-94736

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-107449

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute, a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST...