EUVD-2026-66384

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

EUVD-2026-66364

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device...

CVE-2020-9758

CVE-2020-9758 Beschreibung Ein Problem wurde in chat.php von LiveZilla Live Chat 8.0.1.3 Helpdesk entdeckt. Eine blinde JavaScript-Injektion liegt im Parameter name vor. Das Auslösen kann die Benutzernamen und Passwörter der Helpdesk-Mitarbeiter in der URI abrufen. Dies führt zu einer...

wp2shell-poc

wp2shell PoC Il primo PoC in assoluto della SQL injection basata su timing in pre-autenticazione per la catena di confusione batch-route dell'API REST di WordPress CVE-2026-63030 + CVE-2026-60137 Ottiene l'esecuzione di comandi, senza limitarsi a tentare di forzare la password dell'amministratore...

hopgoblin

hopgoblin hopgoblin é um scanner para instâncias do Adobe Experience Manager AEM. Ele automatiza uma série de verificações que realizamos frequentemente manualmente durante avaliações de segurança. Funcionalidades Detecta endpoints do QueryBuilder expostos: /bin/querybuilder.json...

UniPwn

Analisi dell'iniezione di comandi del servizio BLE del robot Unitree Autore: Bin4ry aka Andreas Makris [email protected] Coautore: h0stile aka Kevin Finisterre Contributore: legion1581 aka Konstantin Severov di theroboverse ha contribuito a correggere il payload per l'iniezione e lo ha...

CVE-2026-82017

IGEL OS 12 (before 12.7.6 ) and 11 (before 11.11.150 ) are affected by a boot registry parameter injection vulnerability. The root cause is an unencrypted and unsigned configuration area that is read by the signed bootloader. An attacker with physical access can write malicious Linux kernel comma...

CVE-2026-41242

CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4 Critical | Code Injection CWE-94 Panoramica protobuf.js npm: protobufjs nelle versioni ≤ 7.5.4 e ≤ 8.0.0 è affetto da una vulnerabilità di esecuzione arbitraria di codice tramite i nomi dei tipi nello schema protobuf. Il modulo...

unknownpwn.github.io

Vulnerabilità ed Exploit dei LED Video Wall Tecnovision. Dalla SQLi al pieno accesso root. Introduzione: Tecnovision è un produttore di LED Video Wall utilizzati negli stadi per esempio, il Twickenham Stadium, nelle sale da concerto, nei centri commerciali, come segnaletica stradale e molto altro...

CVE-2026-3627

IBM Concert versions 1.0.0 through 2.3.1 are vulnerable to SQL injection . A remote attacker with no prior authentication can send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. The vulnerability is rated CVSS 9.1 (CRITICAL) with a network attack v...

CVE-2026-18904

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an authorization bypass (CWE-639) stemming from a namespace collision between user identifiers . The public flow metadata endpoint exposes the owner's user_id, which an unauthenticated attacker can reuse as a client_id to collide with...

Privilege-escalation-ASKEY

Привилегии-эскалация-ASKEY-Router-RTF3505VW-N1 CVE-2022-47040 Уязвимость повышения привилегий на роутерах ASKEY Устройство: ASKEY RTF3505VW-N1 Прошивка: BRSVg000R3505VMN1001s327 не тестировалось на других версиях Версия CLI: ReducedCLIHGUv13 Эксплойт: Устройства ASKEY RTF3505VW-N1 предоставляют...

MAL-011

MAL-011: Неправильная конфигурация Log4J позволяет выполнение вредоносного JavaScript в Red Hat AMQ Компонент Log4J приложения Redhat A-MQ настроен неправильно, что позволяет выполнение произвольных атрибутов “Script” в конфигурации Log4J. Если злоумышленник найдёт способ изменить конфигурацию...

MAL-009

MAL-009: Небезопасное сцепление флагов T и TT в Zip для Linux В Zip для Linux флаг «-TT» может использоваться для выполнения произвольных системных команд. Из-за опасной природы этого флага его всегда следует использовать одновременно с флагом «-T». С помощью атаки со сцеплением флагов...

secpub

Cisco Nexus OS NX-OS - Problemas de "injeção" / sanitização de comandos. Descoberto por: Peter Adkins [email protected] Acesso: Local; é necessário acesso autenticado. Rastreamento e identificadores: CVE - CVE-2011-2569 SOs afetados: Cisco Nexus OS NX-OS Envolvimento do fornecedor: Alertado ...

Vulnerability-Research

🛡️ Ricerca di Vulnerabilità Qui catalogo le vulnerabilità che ho scoperto, i relativi write-up con i dettagli delle debolezze e gli approfondimenti sul loro impatto e sulla loro mitigazione. 🏆 CVE Assegnate...

CVEs

Exploits de Prova de Conceito de CVE da Rhino Uma coleção de scripts de exploit de prova de conceito escritos pela equipe do Rhino Security Labs para várias CVEs. CVE-2025-32815: Bypass de Autenticação no Infoblox NetMRI via Credenciais Embutidas CVE-2025-32814: Injeção de SQL Não Autenticada no...

DS-Wireless-Communication-Remote-Code-Execution

Esecuzione di codice remoto tramite comunicazione wireless DS Inietta codice arbitrario nel gioco di un client. Prerequisiti Python 3.10 pip pydivert Utilizzo root@kitploit: pip install -r requirements.txt python dswirelesscommunicationremotecodeexecution.py ID CVE CVE-2023-45887 Licenza GNU...

Exploits

Exploits Sammlung von Exploits, entwickelt von Ron Jost Für Exploit-Entwicklungsanfragen kontaktiere mich bitte: [email protected] Inhaltsverzeichnis: Wordpress-Plugin XCloner 4.2.12 - Remote-Codeausführung Authentifiziert: CVE-2020-35948 Wordpress-Plugin Modern Events Calendar Lite 5.16.5 -...

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

Vulnerability Details A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints like /?jsonld= and /?pasteid. Root Cause Request::getRequestUri sanitizes $SERVER'REQUESTURI' with FILTERSANITIZEURL: php public function getRequestUri $uri =...