CVE-2019-9194-elFinder-Command-Injection-PoC

CVE-2019-9194 — elFinder Command Injection PoC Command injection vulnerability in elFinder = 2.1.47 via the PHP connector component. Allows unauthenticated remote code execution as the web server user. How it works Uploads a valid JPEG with a malicious filename containing a shell command. Trigger...

Exploit for Argument Injection in Thecodingmachine Gotenberg

CVE-2026-40281 Gotenberg --- 📖 Table of...

cve-2026-61732-lab

CVE-2026-61732 — Decepticon ChatML role-boundary forgery lab A self-contained, disposable lab that reproduces GHSA-g5f9-3xfg-p9mf / CVE-2026-61732: Decepticon , an autonomous red-team agent, wrapped web-crawl output into LLM messages without neutralizing ChatML special-token literals. On a...

VectorFreed

VectorFreed Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I @rafabd1 found in librsvg CVE-2026-96889. In a Node.js/Sharp/libvips build, this bug led to command execution. It covers the bug, the paths confirmed in applications so far, and...

log4j-shell-poc

log4shell-poc CVE-2021-44228 Exploit de prueba de concepto para la vulnerabilidad de Log4j CVE-2021-44228, también conocida como Log4Shell. Esta herramienta genera una clase Java maliciosa, inicia un servidor de referencia LDAP y sirve el payload a través de HTTP, permitiendo a un atacante remoto...

CVE-2026-63077

Resumen • Flujo visual • Requisitos • Uso • Limitaciones • Mitigación !CAUTION Este PoC ejecuta un comando del sistema operativo y puede modificar el directorio de la aplicación TeamCity. Úselo únicamente en un laboratorio aislado o contra sistemas para los que tenga autorización explícita por...

HikvisionExploiter_fixed

HikvisionExploiter Herramienta educativa de seguridad para verificar exposiciones no protegidas de Hikvision y probar CVE-2021-36260 en entornos autorizados. ⚠️ Advertencia legal y ética Este proyecto debe utilizarse solo en sistemas que le pertenezcan o para los cuales tenga permiso explícito par...

CVE-2020-12641

CVE-2020-12641: Inyección de Comandos a través del Parámetro “imconvertpath” en Roundcube Webmail Existe una vulnerabilidad de Inyección de Comandos en las versiones de Roundcube anteriores a 1.4.4, 1.3.11 y 1.2.10. Debido a que "imconvertpath" no realiza sanitización/filtrado de entrada, un...

cacti-rce-snmp-options-vulnerable-application

Cacti v1.2.24 inyección de comandos autenticada CVE-2023-39362 aplicación vulnerable Esta es una aplicación vulnerable para probar el exploit de la vulnerabilidad Cacti CVE-2023-39362. ¡ADVERTENCIA! ¡Esta aplicación contiene vulnerabilidades de seguridad graves. Úsela bajo su propio riesgo! Se...

CVE-2025-58098

CVE-2025-58098 directiva exec cmd=... CVE-2025-58098 inyección de argumentos Laboratorio docker build -t cve-2025-58098-lab . docker run -it -p 8080:80 cve-2025-58098-lab Vulnerable Parcheado...

CVE-2026-97876

A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can...

DEBIAN-CVE-2026-97876

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

UBUNTU-CVE-2026-97876

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

IPFire_2.19_RCE_Authenticated

IPFire 2.19 OINKCODE RCE PoC Prueba de concepto en Python para la vulnerabilidad de inyección de comandos autenticada en la página ids.cgi de IPFire 2.19 a través del parámetro OINKCODE. Solo para pruebas de seguridad autorizadas y laboratorios de formación. Ejecute este PoC únicamente contra...

CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

EUVD-2026-91376

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-97876

A flaw in GRUB2 allows a local attacker with control over the boot configuration to bypass Secure Boot lockdown restrictions. The root cause is the insufficient validation of the MMIO base address passed to the serial command; GRUB fails to verify that the address corresponds to a legitimate UART...

CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

wtfis

wtfis Herramienta de consulta pasiva de hostnames, dominios e IPs para humanos ¿Qué es? wtfis es una herramienta de línea de comandos que recopila información sobre un dominio, FQDN o dirección IP utilizando varios servicios OSINT. A diferencia de otras herramientas de su tipo, está construida...