CVE-2026-123322: JetBrains WebStorm: In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI…

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

CVE-2026-111573: Checkmk GmbH Checkmk: Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the…

Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk 2.5.0p18, 2.4.0p39, 2.3.0p52 and 2.2.0 EOL allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's...

CVE-2026-123853: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process...

CVE-2026-114630: elextensions ELEX WordPress HelpDesk & Customer Ticketing System: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

RHEL 8 : tesseract (RHSA-2026:95725)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95725 advisory. A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNL...

PT-2026-138094

Name of the Vulnerable Software and Affected Versions JetBrains CLion versions prior to 2026.2 Description Remote code execution is possible in Safe Mode through the use of a JSON compilation database. Recommendations Update to version 2026.2...

CVE-2026-82960

A flaw was found in Apache OFBiz. A remote authenticated attacker with Content Management System CMS editor permissions can exploit this code injection vulnerability to achieve arbitrary code execution on the underlying server. By submitting a crafted parameter in an HTTP request to the CMS...

Modified-CVE-2015-3306-Exploit

Modified-CVE-2015-3306-Exploit How to 1. Create a php reverse shell 2. Start server to host shell in the same directory python3 -m http.server 3. Start netcat listener on local port of choice example: nc -nlvp port of choice 4. Run exploit example provided below python3 modifiedCVE20153306.py...

CVE-2026-70659

A flaw was found in stable-diffusion.cpp. An attacker can trigger a heap-based buffer overflow by convincing a user to load a specially crafted importance matrix .imatrix file. Because the application reuses internal memory buffers without resizing them when encountering duplicate tensor entries,...

httpd-2.4.49

httpd-2.4.49 critical: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 incomplete fix of CVE-2021-41773 CVE-2021-42013...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Description This is my PoC for the CVE-2023-30253 Dolibarr 17.0.0 PHP Code Injection, when the CMS Website plugin core is enabled, an authenticated attacker can obtain remote command execution via php code injection bypassing the application restrictions...

CVE-2026-120499

A flaw was found in h5io. This vulnerability allows an attacker to execute arbitrary code by convincing a user to process a specially crafted Hierarchical Data Format HDF5 file. During file parsing in the readhdf5 function, unsafe evaluation and deserialization of embedded objects enables...

CVE-2026-120438

A flaw was found in QuickJS-NG. This vulnerability allows an attacker executing JavaScript code to potentially achieve arbitrary code execution or cause a denial of service DoS through an application crash. The issue occurs due to an integer overflow during proxy property enumeration on 32-bit...

CVE-2026-120434

A flaw was found in Netpbm. An attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS by crashing the application. The flaw occurs in the picttoppm converter when processing a specially crafted PICT image containing an excessive number of...

CVE-2022-1565

WordPress Plugin WP All Import = 3.6.7 - Remote Code Execution RCE Authenticated Ngày: 05 tháng 11 năm 2023 Tác giả khai thác: Việt HÙng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://www.wpallimport.com/ Link phần mềm: https://wordpress.org/plugins/wp-all-import/advance...

ZeroPoint

ZeroPoint.ps1 ⚠ A defensive PowerShell utility to detect and mitigate exploitation of the CVE-2025-53770 zero-day vulnerability in Microsoft SharePoint Server. 🔍 What it Does This PowerShell script is designed to: Detect compromise indicators, such as suspicious .aspx webshells Parse ULS logs to...

CVE-2023-22518

CVE-2023-22518 Exploit for Confluence CVE-2023-22518 backup-restore RCE Endpoint POST /setup/setup-restore.action Requires valid login and admin rights or an auth bypass Files xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!! Replace with any backup...

CVE-2024-2053

LFI to RCE Exploit via Log Poisoning Python3 exploit for CVE-2024-2053 Artica Proxy 📝 Description This Python3 script exploits Local File Inclusion LFI vulnerabilities to achieve Remote Code Execution RCE through log poisoning techniques. Specifically designed for Artica Proxy CVE-2024-2053 but...

jboss-deserialization

JBoss Insecure Deserialization to RCE via CVE-2017-12149. JBoss Insecure Deserialization - RCE Exploitation Lab. The idea here is to setup a lab with an old JBoss version 7.0 in order to exploit the vulnerability. We can use Docker to facilitate all the process. For this, we're gonna need an Orac...

CVE-2026-123208

A flaw was found in noname. The Electron desktop application runs an unauthenticated local file server configured with overly permissive Cross-Origin Resource Sharing CORS settings. A remote attacker can exploit this flaw by tricking a user into visiting a malicious website that sends cross-origi...