CVE-2018-10517

CVE-2018-12613 Ejecución remota de comandos autenticada mediante la carga de un módulo falso, colocando archivos PHP en el servidor web remoto. Software afectado 1. CMS Made Simple 2.2.7; Cómo usar Este script de PowerShell necesita dos parámetros para construir una solicitud HTTP de exploit:...

HardBreacher

HardBreacher Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability So the problem is now leaking outside of Microsoft, there was poll held against either finding a bug in the home or commercial version and the poll results were the commercial version. At the time of writi...

lab-cve-2025-3515

CVE-2025-3515 WordPress Lab Drag and Drop Multiple File Upload for Contact Form 7 Spin up a vulnerable WordPress environment to reproduce and validate CVE-2025-3515 — unrestricted file upload via ddmuuploadfile in the plugin drag-and-drop-multiple-file-upload-contact-form-7 ≤ 1.3.8.9. This lab is...

DEBIAN-CVE-2026-63450

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverabl...

CVE-2026-63450

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverabl...

CVE-2026-63450

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverabl...

CVE-2026-63450

Suricata (OISF) FTP application-layer parser in src/app-layer-ftp.c, prior to 8.0.6 , escalates a protocol-recoverable command-ordering error—RETR/STOR sent before PORT/PASV negotiation —to an unrecoverable APP_LAYER_ERROR (CWE-754 ). This disables all subsequent FTP application-layer inspection ...

Tourmaline

Tourmaline I recently stumbled upon a piece of cleverly designed malware that calls itself "Tourmaline". This README is very kindly written by Claude as I was super busy with exams at the time of this repository's inception. Exploiting and decrypting this malware took a huge chunk of my time from...

CVE-2026-63349

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...

CVE-2026-63349 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...

WordPress Price Drop Alert for WooCommerce plugin <= 1.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Price Drop Alert for WooCommerce versions = 1.1...

CVE-2026-87770

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87770 Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87770 Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87770

CVE-2026-87770 affects the Price Drop Alert for WooCommerce WordPress plugin in versions through 1.1 . The root cause is a lack of sanitization and escaping of parameters before they are used in a SQL query within an AJAX action accessible to unauthenticated users, enabling SQL injection that can...

EUVD-2026-82670

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

Linux Distros Unpatched Vulnerability : CVE-2026-90078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact:...

Linux Distros Unpatched Vulnerability : CVE-2026-90160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modif...

CVE-2026-18351

CVE-2026-18351 Mass exploit tool for CVE-2026-18351 — Unauthenticated Arbitrary File Upload → RCE in Drag and Drop File Upload for Elementor Forms credit johenlastgen | telegram @johenlastgen | channel @jlgnetworkredirect Features Passive vulnerability probe no upload Full exploit mode with shell...

CVE-2026-90160

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...