PT-2026-135444

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/?a=.pdf, bypassing the nginx attachment header ...

PT-2026-135637

Name of the Vulnerable Software and Affected Versions Custom Tables versions prior to 3.7.8 Description An unauthenticated attacker can upload a polyglot file with a controlled extension to the web-accessible tmp directory of a Joomla site that exposes a public Custom Tables submission form. A...

MiracleLinux 8 : aspell-0.60.6.1-23.el8_10 (AXSA:2026-2230:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2230:01 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...

Copyparty 1.8.1 Path Traversal

Copyparty version 1.8.1 and prior versions contain a path traversal vulnerability in the /.cpr endpoint that allows unauthenticated retrieval of files accessible to the service. https://packetstorm.news/download/238906...

CVE-2021-29447-PoC

CVE-2021-29447 Proof-of-Concept ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Written By Isa Ebrahim - 0xRar on January, 2023 ═══════════════════════════════════════════════════════════════════════════ Title: Wordpress XML parsing issue in the Media Library leading to XXE Affected versions: Wordpre...

CVE-2026-84170

Apache Wicket versions 9.14.0 through 9.24.0 and 10.0.0 through 10.9.1 are vulnerable to a resource exhaustion flaw in the AbstractFileUploadResource component. The root cause is that configured upload limits (total size, max part size, and max part count) are bypassed when a client provides thei...

Fortinet FortiNAC keyUpload Cron RCE (CVE-2022-39952)

Horizon3 PoC: unauthenticated POST to /configWizard/keyUpload.jsp with a ZIP placing a cron job under /etc/cron.d/. Use a CMD reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2022-39952 — Fortinet FortiNAC arbitrary file write via keyUpload.jsp Horizon3. Uploads a ZIP whose entr...

osTicket CVE-2026-22200 Patch Detect

Unauthenticated checks from Horizon3 check.py: login username pre-validation v1.18.3+/v1.17.7+ patch and optional open.php HTML srcset stripping. Full CNEXT RCE chain is not bundled — file read alone does not yield a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect osTicket...

FortiSIEM SendQueryResult Arbitrary File Write (CVE-2026-106173)

CVE-2026-106173: unauthenticated path traversal and embedded NUL in SendQueryResult gRPC/HTTP/2, TCP 27918. Overwrite or create arbitrary files — blind, no session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM unauthenticated arbitrary file write blind. Auxiliary:...

osTicket PDF PHP Filter File Read (CVE-2026-22200)

Horizon3: submits an open.php ticket whose rich-text message abuses mPDF list-style-image php://filter chains. Retrieve bytes from the ticket PDF extract BMP / use Horizon3 extractpdfimages.py. No framework session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-22200 — osTicket anonymous...

CVE-2018-2628

Test for Vulnerabilities Upload Shell Method one: Method two: Execute Shell Obtain Meterpreter msf use exploit/multi/script/webdelivery msf exploitmulti/script/webdelivery set target 3 target = 3 msf exploitmulti/script/webdelivery set payload windows/meterpreter/reversetcp payload =...

UsoDllLoader

UsoDllLoader ⚠️ 2020-06-06 Update: this trick no longer works on the latest builds of Windows 10 Insider Preview. This means that, although it still works on the mainstream version of Windows 10 , you should expect it to be patched in the coming months. Description This PoC shows a technique that...

Adobe-ColdFusion-8-RCE-CVE-2009-2265

Adobe ColdFusion 8 - Remote Command Execution RCE Exploit Overview This exploit targets a known vulnerability in Adobe ColdFusion 8 CVE-2009-2265. It enables remote command execution RCE by uploading a malicious JSP payload that establishes a reverse shell connection. Exploit Details CVE :...

LSB-Steganography

LSB-Steganography Python program based on stegonographical methods to hide files in images using the Least Significant Bit technique. I used the most basic method which is the least significant bit. A colour pixel is composed of red, green and blue, encoded on one byte. The idea is to store...

FDsploit

A File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool. FDsploit menu: $ python fdsploit.py -h | | \ | ||| | | | | | -| . | | . | | | || |/|| ||||| ||...ver. 1.2 Author: Christoforos Petrou game0ver ! usage: fdsploit.py -u | -f -h -p -d -e 0,1,2 -t -b -x -c -v --params...

[SECURITY] [DSA 6601-1] eog security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6601-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 01, 2026 https://www.debian.org/security/faq -...

CVE-2021-42671

CVE-2021-42671 CVE-2021-42671 - Broken access control vulnerability in the Engineers online portal system. Technical description: A broken access control vulnerability exists in the Engineers Online Portal. An attacker can leverage this vulnerability in order to bypass access controls and get his...

atomic-operator

license atomic-operator This python package is used to execute Atomic Red Team tests Atomics across multiple operating system environments. What's new? Why? atomic-operator enables security professionals to test their detection and defensive capabilities against prescribed techniques defined with...

columbus-server

Columbus server This repository is deprecated! ‼️ The server component is moved to https://github.com/elmasy-com/columbus. Columbus Project is an API first subdomain discovery service, blazingly fast subdomain enumeration service with advanced features. Subdomain Lookup Columbus returned 638...

CVE-2024-6366

To create a Metasploit module to exploit the RCE vulnerability in the User Profile Builder WordPress plugin before version 3.11.8, we need to take advantage of the lack of proper authorization in the media file upload functionality. Here is how you can create such a Metasploit module: Metasploit...