CVE-2023-46818

CVE-2023-46818 - ISPConfig PHP Code Execution | Exploit High Remote Code Execution in ISPConfig PoC implementation. Resume ISPConfig versions /admin/languageedit.php — ISPConfig vulnerable endpoint 🚀 Launching the Exploit Run the exploit script CVE-2024-47533.py. python3 CVE-2023-46818.py -u -U -...

CVE-2026-96355 Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

EUVD-2026-107826

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96355 Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1...

CVE-2026-96355

The Drupal Webform module (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1 ) is vulnerable to Code Injection due to improper neutralization of special elements used in a template engine. The module fails to sufficiently exclude specific format templates from token replacement, allowing an attacker to...

CVE-2026-96392 AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3...

CVE-2026-96392 AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3...

EUVD-2026-107814

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3...

CVE-2026-96392

The Drupal AI CKEditor module (versions 0.0.0 through 1.4.3 ) is vulnerable to Code Injection due to the improper neutralization of special elements used in a template engine. Specifically, the module fails to sufficiently mitigate Twig template injections in certain AI CKEditor rules, which allo...

CVE-2026-27876

🚨 CVE-2026-27876 - Grafana Critical RCE via SQL Expressions A chained vulnerability allowing arbitrary file writes through SQL Expressions, leading to full Remote Code Execution RCE on the host. 📋 Overview CVE ID : CVE-2026-27876 Severity : Critical CVSS v3.1: 9.1 Published : March 27, 2026 CWE :...

CVE-2025-55182

CVE-2025-55182 RCE Self-use checking tool for CVE-2025-55182 vulnerability Vulnerability Principle React Server Components has a path resolution flaw when decoding payloads sent to server function endpoints. It uses colon-separated object properties to implement nested value access e.g., $1🅰️b...

VulnCheck KEV: CVE-2021-48016

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary...

EXPLOIT-CVE-2026-26216

CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHSA-5882-5rx9-xgxp CVSS 10.0 · pre-auth RCE · CWE-94 Code Injection Unauthenticated remote code execution on the Crawl4AI Docker server field. This code is executed with exec inside a "homemade sandbox" — a restricted builtins dictionary...

POC-exploit-for-Dolibarr

POC exploit for Dolibarr example: python3 exploit.py http://example.com login password 127.0.0.1 9001 ---Reverse Shell Exploit for Dolibarr = 17.0.0 CVE-2023-30253--- positional arguments: hostname Target hostname username Username of Dolibarr ERP/CRM password Password of Dolibarr ERP/CRM lhost...

CVE-2025-3248

CVE-2025-3248 Exploit Tool Documentation Introduction This tool is used to exploit the CVE-2025-3248 vulnerability a Python-based code injection vulnerability to achieve remote command execution RCE on the target server by crafting malicious payloads. The vulnerability exists in a web application...

cve-2025-3248-exploit

CVE-2025-3248: Langflow Unauthenticated RCE Vulnerability Scanner A comprehensive Python exploitation framework for testing and demonstrating CVE-2025-3248 , a critical unauthenticated remote code execution vulnerability in Langflow versions ≤ 1.3.0. 🔴 Vulnerability Overview CVE-2025-3248: Langfl...

CVE-2026-47670

CVE-2026-47670 Authenticated Remote Code Execution via loadReader functionName code injection in DbGate DbGate is an open-source, cross-platform database management tool designed for developers and database administrators who need to work with multiple database systems simultaneously. It provides...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass 📋 Overview CVE-2026-9198 is a critical unauthenticated Remote Code Execution RCE vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities: CVE-2026-9103 : Auto-login bypass that grants superuser JWT token...

CVE-2025-3248-Langflow-RCE

CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution Proof-of-Concept exploit for CVE-2025-3248 , an unauthenticated remote code execution vulnerability in Langflow, an AI/LLM workflow-building platform. Affected versions: Langflow 1.3.0 Fixed in: 1.3.0 Vulnerability class:...

Vitest: Code injection via unauthenticated manual mock registration

Summary @vitest/mocker's interceptorPlugin accepts mock registrations on Vite's dev-server WebSocket with no authentication, and interpolates the mock's url into generated module source without escaping. A client that can reach the dev server can make it serve arbitrary JavaScript in place of any...