MAL-009

MAL-009: Небезопасное сцепление флагов T и TT в Zip для Linux В Zip для Linux флаг «-TT» может использоваться для выполнения произвольных системных команд. Из-за опасной природы этого флага его всегда следует использовать одновременно с флагом «-T». С помощью атаки со сцеплением флагов...

CVE-2026-75118

CVE-2026-75118 is a pre-authentication stack-based buffer overflow in the http_gdpr_decrypt function of the TP-Link TL-MR100 V3.20 router, caused by insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An unauthenticated attacker on an adjacent network can trigger memory...

CVEs

CVE-2022-2992: Удаленное выполнение команд через импорт из Github Информация Описание: Это позволяет аутентифицированному пользователю добиться удаленного выполнения кода через конечную точку API импорта из GitHub. Затронутые версии: все версии с 11.10 до 15.1.6, 15.2–15.2.4, 15.3–15.3.2 Исправле...

DS-Wireless-Communication-Remote-Code-Execution

Esecuzione di codice remoto tramite comunicazione wireless DS Inietta codice arbitrario nel gioco di un client. Prerequisiti Python 3.10 pip pydivert Utilizzo root@kitploit: pip install -r requirements.txt python dswirelesscommunicationremotecodeexecution.py ID CVE CVE-2023-45887 Licenza GNU...

Exploits

Exploits Sammlung von Exploits, entwickelt von Ron Jost Für Exploit-Entwicklungsanfragen kontaktiere mich bitte: [email protected] Inhaltsverzeichnis: Wordpress-Plugin XCloner 4.2.12 - Remote-Codeausführung Authentifiziert: CVE-2020-35948 Wordpress-Plugin Modern Events Calendar Lite 5.16.5 -...

CVE-2026-81532

CVE-2026-81532 affects the MongoDB Connector for BI ODBC driver . The root cause is improper bounds checking on a positioned-cursor statement's cursor name : because the name length is not bounded before the driver builds its diagnostic message, an overly long name overwrites memory adjacent to a...

CVE-2023-49606

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Chiediamo il ritorno sicuro di tutti i cittadini che sono stati presi in ostaggio dal gruppo terroristico Hamas. Non ci fermeremo finché ogni ostaggio non sarà rilasciato e non tornerà a casa sano e salvo. Puoi aiutare a riportarli a...

opendcim-exploit

openDCIM - SQLi para RCE via Envenenamento de Configuração Cadeia de execução remota de código que visa o formulário de configuração LDAP do install.php do openDCIM. Construída sobre o framework VulnCheck go-exploit. Cadeia de Vulnerabilidades...

EvilRip

Cve-2020-5029-finder È un piccolo script per individuare i sottodomini/IP vulnerabili a CVE-2020-5902 scritto in bash. Versioni interessate Nelle versioni BIG-IP 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 e 11.6.1-11.6.5.1, l'interfaccia utente di Traffic Management TMUI,...

CVE-2026-82278

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

CVE-2026-77939

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77184

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in...

CVE-2026-72984

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66798

Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66323

Improper neutralization of parameter/argument delimiters in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

sharepoint-deserialization-security-assessment

CVE-2026-45659 - Microsoft SharePoint RCE da deserializzazione Report di Cybersecurity in Stile Consulenziale Report professionale di valutazione della vulnerabilità per il rischio di deserializzazione in SharePoint, comprensivo di sintesi esecutiva, impatto tecnico, rimedio e strategia di...

write-ups

write-ups RCE in Github Desktop v2.9.4 RCE tramite gh run download GitHub CLI Claude Code: esecuzione di codice non sandboxed da prompt injection tramite confusione del worktree .git — CVE-2026-55607...

Moodle-CVE-2024-43425-Exploit

Exploit RCE per Moodle CVE-2024-43425 Questo repository contiene uno script di exploit in Python che sfrutta una vulnerabilità di esecuzione remota di codice RCE in Moodle CVE-2024-43425. Disclaimer: Questo strumento è fornito COSÌ COM'È solo per scopi educativi e di ricerca. Utilizzalo solo su...

CVE-2025-49132-PoC

CVE-2025-49132 PoC di Pwndalf Panoramica Questo repository contiene un Proof of Concept PoC per CVE-2025-49132, una vulnerabilità di Remote Code Execution RCE che interessa Pterodactyl Panel 1.11.11 Questo PoC è stato sviluppato e testato in un ambiente di laboratorio controllato per scopi di...

CVE-2025-70341

CVE-2025-70341: Permissões Inseguras + Execução Arbitrária de Código no App-Auto-Patch Resumo O App-Auto-Patch v3.4.2 cria seu diretório de trabalho com permissões graváveis por qualquer usuário chmod 777, possibilitando uma condição de corrida TOCTOU time-of-check-time-of-use local. Um atacante...