CVE-2026-27971_POC

CVE-2026-27971 — PoC di RCE non autenticata in Qwik server$ !WARNING Questo repository contiene una proof of concept attiva di esecuzione di codice in remoto. Usala solo contro sistemi di tua proprietà o per i quali hai ricevuto esplicita autorizzazione al test. L'autore non si assume alcuna...

westone-CVE-2020-17519-scanner

westone-CVE-2020-17519-scanner Apache Flink 1.11.0, 1.11.1, 1.11.2 Gli hacker possono leggere/scrivere file remoti tramite API REST Installazione e Utilizzo git clone https://github.com/Osyanina/westone-CVE-2020-17519-scanner.git cd westone-CVE-2020-17519-scanner cmd CVE-2020-17519.exe...

ZDI-CAN-16318

CVE-2023-32162 ZDI-CAN-16318 0-day के लिए एक्सप्लॉइट्स यहाँ आप मेरी लोकल प्रिविलेज एस्केलेशन भेद्यता रिपोर्ट पा सकते हैं। यहाँ आप मेरी आर्बिट्ररी फ़ाइल रीड भेद्यता रिपोर्ट पा सकते हैं। यहाँ आप मेरी आर्बिट्ररी फ़ाइल रीड\राइट भेद्यता रिपोर्ट पा सकते हैं। यहाँ आप मुझे एक यूनिकॉर्न खरीद सकते हैं 🦄...

CVE-2020-11651

CVE-2020-11651 PoC für CVE-2020-11651 Erfordert Python3, getestet auf 3.8 python3.8 -m pip install pyzmq msgpack root@kitploit: ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server ...

CVE-2026-9548

Synology Chat Server versions prior to 2.4.5-22148 are affected by a Cross-Site Scripting (XSS) vulnerability in the extract domain function, caused by improper neutralization of input during web page generation. A remote authenticated user with low privileges can exploit this via a UI interactio...

EUVD-2026-67461

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-40541

Synology Chat Server before 2.4.5-22148 contains an improper input neutralization vulnerability in the extract domain component, classified as a cross-site scripting (XSS) flaw. Remote authenticated users can, through a UI interaction, read or write arbitrary files and trigger denial-of-service a...

Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write

File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler from 3.1.0 before 3.2.2. id: CVE-2024-30188 info: name: Apache DolphinScheduler = 3.1.0, 3.2.2 Resource File Read And Write...

CVE-2025-53964

CVE-2025-53964 जोखिम मूल्यांकन CVSS v3: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - 9.6/10 विवरण GoldenDict 1.5.0 और 1.5.1 में एक उजागर खतरनाक विधि है जो फ़ाइलों को पढ़ने और संशोधित करने की अनुमति देती है जब कोई उपयोगकर्ता एक निर्मित शब्दकोश जोड़ता है और फिर उस शब्दकोश में शामिल किसी भी शब्द की खोज करत...

PT-2026-82623

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2025-25257

CVE-2025-25257 FortiWeb CVE-2025-25257 Exploit https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce exp.py: funktionierender/vollständiger Exploit. signed.py: nur ein PoC von Datei lesen/schreiben. Erste Version des Exploits...

GHSA-WF6J-GR27-G7CH GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...

PT-2026-70992

Name of the Vulnerable Software and Affected Versions Wazuh Manager affected versions not specified Description A deserialization of untrusted data issue exists in the Cluster DAPI Protocol, which allows a remote attacker to execute arbitrary code and perform arbitrary file read and write...

Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

CVE-2026-67594

Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...

CVE-2026-67594 Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

PT-2026-66575

Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...