CVE-2026-104061

A flaw was found in Scribus. This vulnerability allows arbitrary code execution or a Denial of Service DoS due to an out-of-bounds memory write in the Photoshop Document PSD image loader. An attacker could exploit this flaw by convincing a user to import or open a specially crafted PSD file,...

Project-Exploiting-CVE-2024-27198-RCE-Vulnerability

Exploiting CVE-2024-27198-RCE Vulnerability In this project, I exploited the CVE-2024-27198-RCE vulnerability to perform a remote code execution RCE attack on a vulnerable TeamCity server. The vulnerability allows uploading and activating a malicious plugin that provides access to the remote syst...

CVE-2023-36165

CVE-2023-36165 An issue in MiniTool Partition Wizard ShadowMaker v.12.7 allows an attacker to execute arbitrary code and gain privileges via the SchedulerService.exe component. Exploit Title: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path Date: 05/08/2023 Exploit Author: Ida...

fgt-cve-2023-27997-exploit

fgt-cve-2023-27997-exploit FortiGate SSL‑VPN CVE‑2023‑27997 Exploit PoC Script with ROP Chain Table of Contents Description Affected Versions Installation Usage Example Output Technical Details Warnings References Description fgt-cve-2023-27997-exploit.py is a Proof‑of‑Concept PoC exploit script...

log4j2-test

Log4j2 2.14.1 LDAP Remote Code Execution Vulnerability CVE-2021-44228 Verification 🎈 Tested on Spring Boot 2.x environment Vulnerability advisory https://nvd.nist.gov/vuln/detail/CVE-2021-44228 target-server pom.xml : Downgraded Log4j2 version to a vulnerable version 17 2.14.1 LoggingController :...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Yo, in this LetsDefend lab I dove into a SharePoint zero-day called ToolShell CVE-2025-53770. Basically, I mimicked a real-world attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection keys,...

Important: Red Hat Security Advisory: bind9.18 security update

An update for bind9.18 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol UDP message signed with Generic Security Service Transaction Signature GSS-TSIG can replay it while the...

MAL-003

MAL-003: Groovy Security Bypass and Stored XSS in Apache OfBiz A Groovy RCE and XSS have been identified in Apache OfBiz = 18.12.05. Why no CVE? Apache OfBiz does not create CVEs for "post-auth attacks done using demo credentials, notably using the admin user" as mentioned on their security page...

CVE-2026-84243 gettext: Directory traversal via the LANGUAGE environment variable

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

CVE-2026-84243 gettext: Directory traversal via the LANGUAGE environment variable

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

CVE-2026-84243

The gettext family of functions in GNU C Library version 2.0 and later is vulnerable to a directory traversal because it accepts entries in the LANGUAGE environment variable containing / or .. (unless the program is AT_SECURE). An attacker who can control this variable can force the program to lo...

EUVD-2026-114247

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

CLEANSTART-2026-GN56112 Downloading and building modules with malicious version strings can cause local code execution

CVE-2025-68119 affects multiple packages. Downloading and building modules with malicious version strings can cause local code execution. See references for individual vulnerability details...

CVE-2022-20607

CVE-2022-20607 In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

WP_CROP_RCE

WordPress Image CROP RCE Analysis Report POC & Dockerfile : https://github.com/synod2/WPCROPRCE This document covers CVE-2019-8942 and CVE-2019-8943, known as WordPress Image CROP RCE, which are vulnerabilities found in WordPress versions prior to 4.9.9 and 5.0.1. CVE Number| Disclosure Date|...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. usage:...

CVE-2023-25610

CVE-2023-25610 Heap memory underflow in the FortiOS management interface leads to remote code execution. Scope and Limitations 1. Fortinet 6.x 2. Based on TLSv1.3; may vary across other TLS versions Usage python3 cve-2022-42475.py rhost rport lhost 'command' python3 CVE-2023-25610.py 192.168.10.1...

CVE-2026-4813

CVE-2026-4813 CVSS-B 9.4 CRITICAL Authenticated RCE via XSLT injection in Lutece Core Explanations and more on my website /xsl:styleshee...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...