CVE-2026-63720-datamodel-code-generator

CVE-2026-63720: Code Injection in datamodel-code-generator via Unvalidated customBasePath Severity: High, CVSS 3.1 7.5 / CVSS 4.0 7.5 assigned by VulnCheck, the CNA Environmental ceiling network-service deployment: up to 9.8 Vector v4.0:...

react2shell-audit

React2Shell Audit CVE-2025-55182 React2Shell Audit is a lightweight, recursive Bash script designed to detect local Next.js and React Server DOM installations vulnerable to CVE-2025-55182 React2Shell and CVE-2025-66478. 🚨 The Vulnerability React2Shell is a critical remote code execution RCE...

magnus_billing_7.3.0_RCE_CVE-2023-30258

magnusbilling7.3.0RCECVE-2023-30258 There is a remote code execution vulnerability in magnus billing 7.3.0, in the parameter "democ" from the "icepay.php" resource, where you can escape the query and execute the command you want. VULNERABLE CODE if isset$GET'democ' if strlen$GET'democ' 5 exec"tou...

panos-captive-portal-rce

CVE-2026-0300 — PAN-OS User-ID Captive Portal Buffer Overflow RCE Scanner 🎯 Overview Buffer overflow in User-ID Authentication Portal Captive Portal service of PAN-OS. Unauthenticated attacker can execute code as root on affected Palo Alto Networks firewalls. Field| Value ---|--- CVE| CVE-2026-03...

CVE-2025-471812-POC

/ | / | / / | / / / |/ // / / / / / / &password= 2. Server authenticates "anonymous" truncated at NULL but writes full payload into session file → returns UID cookie 3. GET /dir...

CVE-2023-36664

CVE-2023-36664 : Ghostscript remote code execution Proof of concept for the CVE-2023-36664. Usage To insert a payload into a .eps file : python3 poc.py -f "filename" --payload "command" python3 poc.py -f file.eps --payload firefox To insert a reverse shell payload into a .eps file : python3 poc.p...

cve-2021-42013

Apache 2.4.50 - Path Traversal or Remote Code Execution CVE-2021-42013.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.50. Vulnerable instance of Docker is provided to get your hands dirty on CVE-2021-42013 If CGI-BIN is enabled...

CVE-2025-2945

CVE-2025-2945 - pgAdmin4 Authenticated RCE Exploit Author: G0D150NE Version: 2.0.0 CVE: CVE-2025-2945 Severity: Critical CVSS 9.9 📌 Description Exploit for pgAdmin4 Remote Code Execution RCE vulnerability affecting versions 8.10 to 9.1. The vulnerability exists in the /sqleditor/querytool/downloa...

CVE-2024-32004

Create tmp repo, set uploadpack.allowfilter to true git init tmp git -C tmp config uploadpack.allowfilter 1 Clone evil from tmp repo git clone --filter=blob:none --no-local --no-checkout tmp evil rm -rf tmp Configure remote filter script git -C evil config remote.origin.uploadpack...

CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

CVE-2023-38646-PoC-Metabase

CVE-2023-38646-PoC-Metabase Proof-of-Concept script for exploiting CVE-2023-38646. Intended for educational and research purposes only. Description This is a Python-based Proof-of-Concept PoC script to exploit CVE-2023-38646, a vulnerability affecting Metabase. The exploit abuses misconfiguration...

CVE-2023-37941

Exploitation of Pickle RCE within Superset's Default Cache Information Author Dinis Cruz Project Superset Description Apache's superset presents different options for caching, all of which based on Flask-Caching. A built-in cache is provided which serializes values for later retreival. This...

gxv3175-remote-code-exec

Remote code execution for Grandstream GXV3175 VOIP phone. === INSTALLATION === copy the files to the same directory structure under the metasploit top level dir === USE === in msfconsole use exploits/linux/http/grandstreamgxv3175cmdexec set RHOST 192.168.0.1 set USERNAME & PASSWORD if required...

CVE-2022-47986

CVE-2022-47986 Why This vulnerability is exploited in the wild. IceFire use this vulnerability to deploy the ransomware on targeted systems, i would like to help SOC/Blue teams to identify impacted systems and Pentesters/Red teams to exploit and report it. Description I propose pure python and ru...

Seroval: Code injection through a typed array's own constructor property

Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...

EUVD-2026-110462

Seroval: Code injection through a typed array's own constructor property...

GHSA-F86P-H4J2-7QGJ Seroval: Code injection through a typed array's own constructor property

Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...

npm: Seroval: Code injection through a typed array's own constructor property

npm: Seroval: Code injection through a typed array's own constructor property vulnerability discovered by ? in WordPress npm seroval versions = 1.6.0, 1.6.11...

CVE-2026-34197

🚨 CVE-2026-34197 — Critical Jolokia RCE in Apache ActiveMQ Authenticated RCE via Jolokia MBeans → Remote Spring XML → JVM Code Execution 📖 Overview CVE-2026-34197 is a high-severity authenticated remote code execution vulnerability affecting Apache ActiveMQ Classic. The issue exists in the Joloki...

GHSA-7RV5-MRXV-XCR9 Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Summary When fromJSON rebuilt an async iterator, it called on on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's o...