Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Fijación de Sesión en Vvveb CMS v1.0.6.1 Autor: Andrew Paul Fecha de Descubrimiento: 9 de junio de 2025 Vendedor: Vvveb URL del Vendedor: http://vvveb.com GitHub del Vendedor: https://github.com/givanz/Vvveb Versión Afectada: 1.0.6.1 y probablemente versiones anteriores ID CVE: CVE-2025-8517...

cve-2017-5941-poc-docker-lab

CVE-2017-5941 — PoC de deserialización no confiable en node-serialize RCE ⚠️ Solo para laboratorio / autoevaluación. Úsalo únicamente en sistemas que poseas o estés autorizado a probar. Este repositorio proporciona: Un script PoC mínimo para reproducir CVE-2017-5941 contra una aplicación Node.js...

CVE-2026-78122-POC

CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...

CVE-2025-29471

Vulnerabilidad XSS Almacenado en Nagios Log Server Escalada de Privilegios a Admin ▶️ PoC Demo Fecha: 2025-04-02 Autor del Exploit: Seth Kraft Página del Proveedor: https://www.nagios.com/ Registro de Cambios del Proveedor: https://www.nagios.com/changelog/log-server Enlace del Software:...

CVE-2020-8158

CVE-2020-8158: TypeORM Prototype Pollution Vulnerability Overview This is a proof-of-concept demonstrating CVE-2020-8158, a critical prototype pollution vulnerability in TypeORM versions 0.2.25. Vulnerability Details CVE ID : CVE-2020-8158 CVSS Score : 9.8 CRITICAL Affected Package : TypeORM 0.2....

CVE-2026-52616

CVE-2026-52616 — mcp-nmap-server: OS command injection via runnmapscan The runnmapscan MCP tool builds its command by string interpolation of the target and additionalFlags parameters and runs it through childprocess.exec, i.e. /bin/sh -c. ⚠ Read this first — duplicate identifier This vulnerabili...

CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-

Security Advisory: Unauthenticated Memory Leak Leads To Memory Exhaustion TinyWeb Assigned CVE ID: CVE-2026-67183 Summary TinyWeb allocates several objects while parsing each request and never frees them. The request and header structures have no destructors, and nothing deletes them after the...

cve-2024-3400-panos_rce_reproduction

CVE-2024-3400: Palo Alto PAN-OS GlobalProtect Command Injection RCE CVSS 10.0 CRITICAL | CWE-78: OS Command Injection | Mass Exploited In The Wild Overview CVE-2024-3400 is a pre-authentication command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway interface...

CVE-2026-22557

🛡️ CVE-2026-22557 - Critical Path Traversal Vulnerability in Ubiquiti UniFi Network Application 📋 Overview A critical unauthenticated path traversal vulnerability CWE-22 exists in the Ubiquiti UniFi Network Application UniFi Controller. An attacker with network access can exploit this flaw to:...

CVE-2026-59243

CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass Korean: README.ko.md Apache advisory: https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl published 2026-07-29 CVE record: https://vulners.com/cve/CVE-2026-59243 Fixed in: apache-airflow-providers-fab==3.7.3 Class:...

cve-2026-21509-office_security_bypass_reproduction

CVE-2026-21509 — Omisión de la función de seguridad de Microsoft Office CVE-2026-21509 es una vulnerabilidad de omisión de la función de seguridad de Microsoft Office CVSS 7.8 , explotada activamente por APT28 hackers rusos contra Ucrania Dependencia de entradas no confiables en decisiones de...

CVE-2025-26198

🛡️ CVE Disclosure: CVE-2025-26198 — SQL Injection in CloudClassroom-PHP-Project Disclosure Date: 18 June 2025 CVE ID: CVE-2025-26198 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in CloudClassroom-PHP-Project v1.0, specifically within the loginlinkadmin.php...

CVE-2025-0324-axis-vapix-privesc

CVE-2025-0324 — Root Cause Analysis A client-controlledHost header as a root-group backdoor in the AXIS OS VAPIX Device Configuration framework. %20%2F%208.8%20High%20\NVD-b3261e TL;DR Axis Communications disclosed CVE-2025-0324 on 2025-06-02 as a critical CVSS 9.4 privilege-escalation flaw in th...

CVE-2020-2034-POC

CVE-2020-2034-POC Determinar la versión que ejecuta el firewall de Palo Alto Networks para el Global Protect Portal Recientemente, Palo Alto Networks anunció muchas vulnerabilidades críticas aquí: https://security.paloaltonetworks.com/?severity=CRITICAL&product=PAN-OS&sort=-date Este es un PoC pa...

CVE-2026-50522

🛡️ CVE-2026-50522 — Microsoft SharePoint RCE Investigation Critical SharePoint Deserialization Vulnerability Under Active Exploitation Created by Pratik Chhetri Report Date: 2026-07-27 📌 Executive Snapshot...

vader

VADER: A Human-Evaluated Benchmark for Vulnerability Assessment, Detection, Explanation, and Remediation Official GitHub Repo:https://github.com/AfterQuery/vader Hugging Face Dataset:https://huggingface.co/datasets/AfterQuery/vader VADER is a human-evaluated benchmark designed to measure how well...

http-vuln-cve2019-14322.nse

http-vuln-cve2019-14322.nse Nmap NSE script to detect CVE-2019-14322 of Pallets Werkzeug path traversal via SharedDataMiddleware mishandles drive names such as C: in Windows pathnames Description CVE-2019-14322 - A vulnerability was found in Pallets Werkzeug up to 0.15.4. It has been declared as...

cve-2026-33067

CVE-2026-33017 — Langflow Unauthenticated RCE Nuclei Template Nuclei template that detects CVE-2026-33017 — an unauthenticated remote-code-execution vulnerability in Langflow ≤ 1.8.2 reachable through the public flow-build endpoint: root@kitploit: POST /api/v1/buildpublictmp/flowid/flow The...

CVE-2026-39808

CVE-2026-39808 Fortinet FortiSandbox 4.4.0-4.4.8 - Inyección de comandos del SO a través del endpoint tracer-behavior Fortinet FortiSandbox es una solución avanzada de protección contra amenazas que crea entornos aislados para analizar archivos sospechosos, URL y tráfico de red en busca de...

CVE-2026-1208

CVE-2026-1208: Cross-Site Request Forgery in Friendly Functions for Welcart Keywords: CVE-2026-1208, Friendly Functions for Welcart vulnerability, CSRF, Cross-Site Request Forgery, WordPress security, WordPress plugin vulnerability, CWE-352, Welcart security, settings manipulation, WordPress CVE...