CVE-2020-2038

CVE-2020-2038 Exploit to capitalize on vulnerability CVE-2020-2038. According to Palo Alto Networks: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS...

phpipam_1.4.4

CVE-2022-23046 phpIPAM 1.4.4 - SQL Injection phpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the subnet parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This project currently prints out database information and host version...

CVE-2024-31114

CVE-2024-31114 - WordPress Shortcode Addons RCE Exploit Shortcode Addons = 3.2.5 – Authenticated Admin+ Arbitrary File Upload CVE ID: CVE-2024-31114 CVSS Score: 9.1 Critical 🛠️ Vulnerability Description The Shortcode Addons – with Visual Composer, Divi, Beaver Builder, and Elementor Extension...

CVE-2023-50564

CVE-2023-50564 📌 Description This exploit allows an authenticated admin in Pluck CMS v4.7.18 to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution RCE. ⚙️ Features Authenticates to the target using a valid username and password Automatically creates a ZIP...

CVE-2022-23046

CVE-2022-23046 The original discovery and manual PoC is from Fluidattacks: PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This PoC executes some easy SQLi to fetch info...

CVE-2019-19511

CVE-2019-19511 Chevereto - 1.0.0 Free - 1.1.4 Free, = 3.13.4 Core, Remote Code Execution Description installer.php in Chevereto through 1.1.4 Free, and through 3.13.4 Core, allows remote authenticated admins to execute arbitrary PHP code by injecting this code into the setup process and overwriti...

EKC Tournament Manager WordPress plugin - Path Traversal

EKC Tournament Manager WordPress plugin 2.2.2 contains a path traversal caused by insufficient validation, letting logged in admin users download system files outside the WordPress directory. id: CVE-2024-9765 info: name: EKC Tournament Manager WordPress plugin - Path Traversal author: Sourabh-Sa...

CVE-2021-21014

PoC Limited CVE-2021-21014 Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Affected version: = Magento 2.4.1 User...

CVE-2026-66493

Path Traversal in File Operations Delete / Copy / Move PhocaCommander ≤ 6.1.3 — Authenticated Admin Manipulates Files Outside Webroot SUMMARY The file action handler in PhocaCommander constructs source and destination paths from attacker-controlled base64-encoded parameters pathfrom, pathwhere...

CVE-2026-66491

Arbitrary File Read via getSource in PhocaCommander PhocaCommander ≤ 6.1.3 — Authenticated Admin Path Traversal, No CSRF Required SUMMARY An arbitrary file read vulnerability exists in PhocaCommander's file editor endpoint. The getSource function decodes a base64-encoded filename parameter and...

CVE-2026-44403-WingFTP-v8.1.2-POC-Exploit

Wing FTP Server v8.1.2 содержит уязвимость удаленного выполнения кода RCE в механизме сериализации сессий. Аутентифицированный администратор может внедрить произвольный код Lua через поле mydirectory basefolder администратора домена, который выполняется на стороне сервера через loadfile. Это...

CVE-2025-10307

Exploit: Arbitrary File Deletion via Backuply tarfile path traversal Browser Console PoC authenticated admin root@kitploit: async = const page = $location.origin/wordpress/wp-admin/admin.php?page=backuply; // 1 Extract a valid nonce from the Backuply page const html = await fetchpage, credentials...

CVE-2026-88281

GeoVision GV-LPC2211 V1.13 contains a stack overflow vulnerability in its ONVIF DeleteUsers endpoint. The failure to limit repeated Username elements in a DeleteUsers request allows an authenticated administrator to overflow a stack array and crash the ONVIF worker process, resulting in a denial ...

CVE-2026-0308

This CVE entry is reserved with no public technical details yet. The affected product, root cause, and impact are not specified in the provided documents. Monitor for updates as details are expected once the vulnerability is publicly announced.

EUVD-2026-75256

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

CVE-2025-8081-Elementor

CVE-2025-8081 - Elementor Arbitrary File Read Vulnerability A critical arbitrary file read vulnerability in Elementor WordPress plugin that allows authenticated administrators to read any file accessible by the web server, including sensitive configuration files containing database credentials. 📋...

CVE-2026-12948

CVE-2026-12948 Vulnerability Summary A stored cross-site scripting XSS vulnerability was identified in the web management interface of the Digi PortServer TS 4 H MEI. A specially crafted, authenticated request allows a script payload to be permanently written to device configuration storage. The...

Weblate-CVE-2026-24126

Weblate — Arbitrary File Read via SSH Host Argument Injection Discovered by: Alejandro Baño · January 2026 Acknowledged by: Weblate 5.16 release notes Overview Weblate's SSH host key management endpoint passes the host parameter supplied by an authenticated administrator directly tossh-keyscan...

PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...