CVE-2025-53694-to-CVE-2025-53691

Sitecore CVE Chain Exploits This repository contains proof-of-concept exploits for a critical vulnerability chain in Sitecore Experience Platform XP versions up to 10.4.1. Vulnerabilities CVE-2025-53694: Information Disclosure CVE-2025-53693: Cache Poisoning CVE-2025-53691: Remote Code Execution...

MAL-2026-18410 Malicious code in apex-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6e333b1835e39c7456b9e9ad49d5582e9c4d0b56f1ca5884ee7ed02e8b5cbc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18412 Malicious code in ourin-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4045a1463ae4951c8b31784eb251ddf2513419645339229d2b46c6b1a4804f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

cve-2021-33879

CVEID : CVE-2021-33879 Name of the affected products and versions : GameLoop all versions prior to 4.1.21.90 Vulnerability type : CWE-494: Download of Code Without Integrity Check Summary GameLoop is an Android emulator developed by Tencent. It features an update mechanism which is not encrypted ...

CVE-2023-36159

CVE-2023-36159 Cross Site Scripting XSS vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page...

CVE-2025-48384-RCE

CVE-2025-48384-RCE...

MAL-001

MAL-001: FreeMarker Server-Side Template Injection in Liferay Portal An issue was discovered in Liferay - Portal =7.4.3.12-ga12. By inserting malicious content in the FTL Templates, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects ...

CVE-2019-15107-RCE-WebMin

Webmin CVE-2019-15107 Detection A lightweight Python script that fingerprints Webmin versions and flags any server running 1.882 ≤ version ≤ 1.920 as potentially vulnerable to CVE-2019-15107. This tool does not exploit the vulnerability—only reports it. Prerequisites Git Python 3.7+ Docker & Dock...

CVE-2020-7246

CVE-2020-7246 qdPM 9.1 - Remote Code Execution...

Shellshock_vuln_Exploit

🚨 Shellshock RCE Exploit CVE-2014-6271 This is a Python exploit for the Shellshock vulnerability CVE-2014-6271, which affects GNU Bash. The exploit targets CGI scripts on vulnerable web servers and establishes a reverse shell to the attacker's machine. CVE ID CVE-2014-6271 Disclaimer This tool is...

CVE-2019-16113

Bludit 3.9.2 - Remote command execution - CVE-2019-16113 This exploit combines two exploits in Bludit CMS 3.9.2 to gain remote code execution on the target system. The original exploits are CVE-2019-17240 & CVE-2019-16113. Features Bruteforce password + RCE Bruteforce username:password + RCE...

Pickle-Deserialization-Exploit-in-Transformers

Exploiting Pickle Deserialization Vulnerability in Transformers Experiment Introduction Introduces the pickle deserialization mechanism and its reduce attack principle, reproduces the deserialization vulnerability CVE-2024-3568 in the Hugging Face Transformers library, analyzes security risks in...

CVE-2026-119718

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcachedataalloc when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute...

CVE-2026-119719

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write whe...

CVE-2026-119722

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in readstruct that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer...

CVE-2026-119717

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-119716

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to...

CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119479

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1...