CVE-2026-22444

CVE-2026-22444 Apache Solr UNC Path Validation Vulnerability Overview CVE-2026-22444 is a security vulnerability affecting Apache Solr, publicly disclosed around January 20, 2026. The vulnerability stems from insufficient input validation CWE-20: Improper Input Validation on certain API parameter...

CVE-2017-3241-POC

CVE-2017-3241-POC POC para la vulnerabilidad de deserialización de Java RMI Probablemente necesites usar JDK 8 para ejecutar este poc. Solo presta atención a la clase Message tanto en el lado del cliente como en el del servidor. Son diferentes. Y la diferencia es la clave para entender esta...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 es una vulnerabilidad XSS reflejado en Wonder CMS que permite ejecutar código arbitrario a través de un script malicioso mediante el componente installModule. Uso Ejecutando el exploit contra la loginURL del objetivo, especificando nuestra IP y puerto para el servido...

CVE-2025-55182

Escáner CVE-2025-55182 Este repositorio contiene una herramienta de escaneo para CVE-2025-55182 , una vulnerabilidad crítica de Ejecución Remota de Código RCE en los Componentes del Servidor React RSC. ⚠️ Aviso legal Esta herramienta es solo para fines educativos y de pruebas autorizadas. No...

DVWA-ZAP-PENTEST

Evaluación de Vulnerabilidades de DVWA usando OWASP ZAP Una evaluación práctica de seguridad de aplicaciones web de DVWA Damn Vulnerable Web App , realizada usando OWASP ZAP Zed Attack Proxy 2.17.0. Este proyecto documenta el flujo de trabajo completo: reconocimiento spidering, escaneo automatiza...

Microsoft SQL Server Reporting Services - Remote Code Execution

Microsoft SQL Server Reporting Services is vulnerable to a remote code execution vulnerability because it incorrectly handles page requests. id: CVE-2020-0618 info: name: Microsoft SQL Server Reporting Services - Remote Code Execution author: joeldeleep severity: high description: Microsoft SQL...

Gitea 1.1.0 - 1.12.5 - Remote Code Execution

Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the...

Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...

WordPress File Manager Plugin - Remote Code Execution

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. id: CVE-2020-25213 Uploaded file will be accessible at:-...

Apache OFBiz < 18.12.11 - Remote Code Execution

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery SSRF id: CVE-2023-51467 info: name: Apache OFBiz 18.12.11 - Remote Code Execution author: your3cho severity: critical description: | The vulnerability allows attackers to bypass...

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization

Jenkins Pipeline: Groovy Plugin workflow-cps version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiation of CPS-transformed pipeline scripts, sandbox protections are not applied, allowing authenticated users with...

Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE

Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP. id: CVE-2026-35273 info: name: Oracle PeopleSoft PeopleTool...

kernel: zram: fix use-after-free in zram_bvec_write_partial()

A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the zrambvecwritepartial function allows an asynchronous read to write into a page...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar Timezone Abbreviation Heap Buffer Overflow PostgreSQL tochar function has a heap buffer overflow vulnerability when handling timezone formatting. By setting an overly long POSIX timezone abbreviation, an attacker can trigger an out-of-bounds write to a fixed...

CVE-2021-1675-PrintNightmare-Analysis

Vulnerability Research: Local Privilege Escalation and RCE via Windows Print Spooler PrintNightmare / CVE-2021-1675 The repository contains a detailed technical report write-up and an analysis of the exploit concept for a critical vulnerability in the Windows Print Spooler service, which allows a...

WSUSResponder

🧰 WSUSResponder Version: 1.0.1 Author: RZA / IT Operations License:MIT 🎯 Objective The WSUSResponder module provides a set of PowerShell tools to quickly respond to the critical vulnerability CVE-2025-59287 , a remote code execution RCE flaw affecting Windows Server Update Services WSUS. It allow...

CVE-2025-62593-PoC

CVE-2025-62593 — Ray Remote Code Execution unauthenticated Proof-of-concept for CVE-2025-62593 , an unauthenticated Remote Code Execution vulnerability in the Ray distributed AI compute engine, abused via browser-based DNS-rebinding attacks. It was added to the CISA Known Exploited Vulnerabilitie...

CVE-2021-31630

CVE-2021-31630 CVE encontrada al jugar con una máquina de HTB. El exploit de exploit-db tiene algunos errores, por lo que se proporciona una forma manual de explotación y un exploit. Uso del script Ejecución de comandos sin salida visible root@kitploit: python exp.py -u http://127.0.0.1:8080 -l...