CVE-2022-42092

CVE-2022-42092 Python-эксплойт 🔥 Описание Этот скрипт эксплойта на Python нацелен на неограниченную загрузку файлов в Backdrop CMS для достижения удалённого выполнения кода RCE. ⚠️ Затронутые версии Версия 1.22.0 и более ранние версии Примечание: Backdrop CMS оспаривает это и утверждает, что...

poc_CVE-2018-1002105

CVE-2018-1002105 PoC 인증된 PoC 데모 사용법 인증되지 않은 PoC 데모 사용법 인증된 PoC CVE-2018-1002105에 대한 Proof-of-Concept 익스플로잇입니다. 현재 익스플로잇은 pods와 pods/exec에 대한 create 및 get 권한이 필요합니다. portforward 및 attach에 대한 지원이 추가되었으며, 이와 유사한 권한이 필요합니다. 현재 PoC는 기본 etcd-kubernetes 파드에서 시크릿을 덤프합니다. 데모 작동 중인 PoC: 사용법 usage: poc.py -...

CVE-2024-21683-RCE

Использование python poc.py -u http://localhost:8090 -user admin -pass admin -f exploit.js -n test -p http://127.0.0.1:8080 POC...

offsec-karaf-exploits

offsec-karaf-exploits Использование: python exploit.py --help Пример: python exploit.py --rhost=192.168.0.133 --rport=1337 --lhost=192.168.0.100 --lport=4444 --creds=karaf:karaf Пересборка Payload Настройка Felix Framework 1. Создайте каталог lib mkdir -p ./revshell/lib 2. Скачайте Felix Framewor...

CVE-2025-12030

CVE-2025-12030: Небезопасная прямая ссылка на объект в плагине ACF to REST API для WordPress Ключевые слова: CVE-2025-12030, уязвимость ACF to REST API, IDOR, безопасность WordPress, эксплойт с аутентификацией, уязвимость плагина WordPress, CWE-639, изменение полей ACF, обход авторизации, WordPre...

CVE-2024-40617

CVE-2024-40617 Эксплойт PoC для CVE-2024-40617 Описание Подробное описание см. в публикации на Medium Fujitsu M2M GW1500 : From M2M to M2M2P0wn Использование | / | \ | | \ / \ | |/| | | ' \ | | | | | \ \ /\ / / ' \ | | | |/ /| | | | | |/ /| /| || |\ V V /| | | | || |||| || |||| / // || ||...

CVE-2025-24367-PoC-Cacti

Cacti CVE-2025-24367 Авторизованный RCE PoC Этот репозиторий содержит доказательство концепции эксплуатации CVE‑2025‑24367 — уязвимости авторизованного удалённого выполнения кода в Cacti. Проблема связана с недостаточной санитазацией ввода при обработке шаблонов графиков. Внедряя вредоносное...

CVE-2026-73714 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API

A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege level, potentially leading to further...

CVE-2026-58567

Dell PowerStore is affected by an OS Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, changed scope...

CVE-2026-58572

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

Exploit for CVE-2026-19295

Description Proof o...

GHSA-F2P5-J6FG-5CXF Wagtail: Denial of service via unbounded filter specs in the image preview

Impact An authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patches Patched versions have be...

EUVD-2026-63271

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77075

n8n's editor splices resource-locator field values into node URL templates without expression-syntax checks, enabling an authenticated user to inject JavaScript evaluated in another user's session. CVSS 8.4 HIGH. Affected: <1.123.69, 2.x <2.33.4, 2.34.x

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

EUVD-2026-62893

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format PDF file, Splunk...

PT-2026-78940

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 n8n versions 2.33.x prior to 2.33.4 Description The SearXNG Agent tool contains a Server-Side Request Forgery SSRF protection bypass. This occurs because the tool utilizes a raw HTTP client to send requests to a...

PT-2026-78938

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description An authenticated user with permissions to create and execute workflows can achieve a sandbox escape within the JavaScript Code node. This occu...