CVE-2017-1000486

CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...

CVE-2025-9223

Applications Manager - Execute Program Action Bypass PoC 📖 Description This repository contains a Proof of Concept PoC that demonstrates a command execution vulnerability in the "Execute Program Action" feature of ManageEngine Applications Manager. 🔍 Vulnerability Details Applications Manager use...

xss_vulnerability_challenges

Escenarios de Vulnerabilidad XSS desafíos Este repositorio es una aplicación PHP Dockerizada que contiene algunos desafíos de vulnerabilidad XSS. Las ideas detrás de los desafíos son: Bypass de validación de JavaScript Bypass de entidades HTML Bypass de WAF Bypass de validación de lista negra...

CVE-2025-51458-exp

CVE-2025-51458-exp Pre-Auth SQL Injection in DB-GPT --sql "SELECT VERSION" Dump tables python3 exp.py http://target:5670 --dump-tables Dump schema python3 exp.py http://target:5670 --dump-db DuckDB bypass python3 exp.py http://target:5670 --duckdb-bypass --sql "SELECT CURRENTSETTING'accessmode'"...

CVE-2020-8840

CVE-2020-8840: FasterXML/jackson-databind Remote Code Execution Vulnerability 0x00 Introduction jackson-databind is a JSON processing library under the FasterXML project. 0x01 Vulnerability Overview On February 19, NVD released a security advisory disclosing a remote code execution vulnerability...

CVE-2020-10673

Vulnerability Description Recently, the Asiainfo Security Network Attack and Defense Laboratory tracked that jackson-databind has updated a JNDI injection blacklist class. If the jar package of this class exists in the project and the JDK version meets the injection version, remote code execution...

CVE-2026-1337-AI-Coding-Assistant-Prompt-Injection-to-Sandbox-Escape

CVE-2026-1337 – AI Coding Assistant Prompt Injection to RCE 📖 Overview A prompt injection vulnerability in an AI-powered code review bot allows an attacker to inject arbitrary shell commands by manipulating the bot’s “fix” suggestion. The sanitizer uses a simple blacklist that is bypassed using...

monstra_cms-3.0.4--getshell

monstracms-3.0.4--getshell monstracms-3.0.4-upload getshell CVE-2018-17418 Code analysis: In line 150 of monstra\plugins\box\filesmanager\filesmanager.admin.php, there is a forbiddentypes variable used as a blacklist restriction. Continue to follow this variable. In the line 150 of...

GHSA-P279-5WCV-45VQ Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Summary The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as webshell.pHp therefore bypassed the blacklist and was written to the web-accessible upload directory as...

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Summary The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as webshell.pHp therefore bypassed the blacklist and was written to the web-accessible upload directory as...

GHSA-RQX7-P7VV-W7HR Hydra instantiate target blacklist bypasses permit code execution

Summary Hydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete. Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...

CVE-2019-19576

class.upload.php = 2.0.3 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verot.net Affected product - class.upload.php = 2.0.3 Tested on newly installed Ubuntu 19.10 with PHP7.3 and Apache/2.4.38 Specifically Debian/Ubuntu has been found to be vulnerable since they add the php,...

CVE-2026-106442

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable...

CVE-2026-106442 Hydra instantiate target blacklist bypasses permit code execution

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable...

CVE-2026-106442

The Hydra configuration framework is vulnerable to code execution in versions 1.3.4 through 1.3.6 and 1.4.0.dev9 . The instantiate() target blacklist, originally intended to mitigate CVE-2026-68508, fails to sufficiently validate the effective callable selected by the target field. Attackers can ...

CVE-2026-106442 Hydra instantiate target blacklist bypasses permit code execution

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable...

CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE

make it a readme.md to paste into it CVE-2025-69906: Monstra CMS 3.0.4 Arbitrary File Upload to RCE Author : David PS Abraham Date : February 5, 2026 Severity : Critical - Remote Code Execution CVSS 8.8+ CWE : 434 Unrestricted Upload of File with Dangerous Type Vulnerability Description Monstra C...

fastjson-1.2.61-RCE

fastjson-1.2.61-RCE Ps： Officially, in https://github.com/alibaba/fastjson/blob/master/src/main/java/com/alibaba/fastjson/parser/ParserConfig.java, 0x7bddd363ad3998c6L i.e., 1.2.61 8925522461579647174 0x7bddd363ad3998c6L org.apache.commons.configuration.JNDIConfiguration was added to the blacklis...

CVE-2026-33234

How I Turned AutoGPT's Email Feature Into an Internal Network Scanner CVE-2026-33234 | Moderate 5.0 | GHSA-4jwj-6mg5-wrwf Author: Pavan Nallamothu I was mapping every user-controlled input that touched the network in AutoGPT Platform. The HTTP layer was locked down tight. Private IP ranges...

CVE-2026-104890 Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...