SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare - n8n RCE Full Chain Exploit 1. Executive Summary & Overview This document presents a deterministic technical reconstruction analysis of the CVE-2026-21858 vulnerability, internally...

CVE-2026-25769---CVE-2026-25770

CVE-2026-25769 / CVE-2026-25770 – Wazuh Cluster Vulnerabilities Warning: This repository contains information and code related to security vulnerabilities. Use it only for educational purposes or in authorized environments. Description Two critical vulnerabilities have been identified in the Wazu...

spark-history-zip-symlink

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-history-zip-symlink Write-up: https://abraxaslabs.tech/research/spark-history-zip-symlink spark-history-zip-symlink Class: File read Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation...

CVE-2023-45878

CVE-2023-45878 Wrote this script based on the work of https://herolab.usd.de/security-advisories/usd-2023-0025/ . The exploit works by using an Arbitrary File Write exploit in Gibbon LMS 25.0.1 . This PoC will use upload a simple php cmd script, and then use that to load a powershell revshell...

OverlayFS---CVE-2021-3493

TL;DR Find out how a vulnerability in OverlayFS allows local users under Ubuntu to gain root privileges. Vulnerability Summary An Ubuntu specific issue in the overlayfs file system in the Linux kernel where it did not properly validate the application of file system capabilities with respect to...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

log4shell

log4shell Python Script to scan the server file system for log4j jars that are vulnerable to CVE-2021-44228 and CVE-2021-45046. The script recursively goes through the file system including zip, ear, war to find log4j versions 2. to 2.15 with org/apache/logging/log4j/core/lookup/JndiLookup.class...

CVE-2023-44767_RiteCMS-File-Upload--XSS---Filemanager

RiteCMS 3.0 File Upload - XSS Author: Sergio Description: File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a svg file with XSS content. Attack Vectors: AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L POC: We create an svg file with the following content: When logging into the panel,...

CVE-2023-4220-Exploit

CVE-2023-4220-Exploit LMS Chamilo 1.11.24 CVE-2023-4220 Exploit Exploit usado para CVE-2023-4220 aprovecha el error de programacion del LMS Chamillo el cual nos permite subir un fichero al servidor sin ningun tipo de restriccion. Este Exploit fue escrito para nuestra maquinita Easy permX de HTB,...

CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

Grafana-LFI-exploit

Grafana LFI exploit Updated exploit script for the CVE-2021-43798 from the following: https://www.exploit-db.com/exploits/50581 https://vulncheck.com/blog/grafana-cve-2021-43798 Usage 1. Update on line 5 ip and line 6 port to fit the target. 2. Run the script python3 grafana-exploit.py...

cpanel-pwn

cpanel-pwn cPanel/WHM security testing toolkit. Implements the CVE-2026-41940 CRLF injection authentication bypass and post-exploitation privilege pivoting. Tools Script| Purpose ---|--- cpanelexploit.py| CVE-2026-41940: CRLF injection → WHM auth bypass → root access CVE-2026-41940 Type: CRLF...

CVE-2026-34990-poc

CVE-2026-34990 — CUPS Local-Printer PoC Authorized testing / research use only. Run this PoC only against systems you own or are explicitly authorized to test. This repository contains a system-CUPS-oriented reproduction of the local-printer vulnerability in CUPS 2.4.16. The implementation was...

CrushFTP-SSTI-LFI-Proof-of-Concept

CVE-2024-4040 — CrushFTP SSTI / LFI Proof of Concept For educational and authorised lab use only. CS443 Software and Systems Security — controlled local Docker environment. Vulnerability Summary Field| Detail ---|--- CVE| CVE-2024-4040 Affected Software| CrushFTP … that the server evaluates and...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite putcontents $dir . $name, $item'data' ; The filename ../../plugins/shell.php concatenated with $dir wp-content/uploads/crm-attachments/ resolves to wp-content/plugins/shell.php — a directory...

ptrace_may_dream

ptracemaydream CVE-2026-46333 Local privilege escalation exploit for the ptracemayaccess mm=NULL race condition in pidfdgetfd2. When a process is dying and its mm has already been released, the kernel skips the ptrace access check entirely. By racing pidfdgetfd against process exit, an unprivileg...

CVE-2021-22204

CVE-2021-22204 Summary of the CVE Improper sanitization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image. Affected Versions Version 7.44 - 12.23 Anomalies Dependencies: djvulibre-bin exiftool Calls these three...

cve-2026-21440-writeup-poc

cve-2026-21440 path traversal to arbitrary file write in @adonisjs/bodyparser overview a critical path traversal vulnerability exists in the @adonisjs/bodyparser package that allows remote attackers to write arbitrary files outside the intended upload directory. when the multipartfile.move functi...

CVE-2024-34693

CVE-2024-34693 Exploit This repository contains a sophisticated Python script to exploit the CVE-2024-34693 vulnerability in Apache Superset. The script sets up a rogue MySQL server and creates a malicious MariaDB connection to exfiltrate the content of a specified file from the target system...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p Project|...