EUVD-2026-70314

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040

ZhongBangKeJi CRMEB (up to 6.0.0 ) is vulnerable to OS command injection in the Custom Scheduled Task feature. The eval function in /adminapi/system/crontab/save unsafely processes the customCode argument, allowing remote attackers to inject operating-system commands. The vendor documents this as...

QuickBox-Pro-2.1.8-Authenticated-RCE

QuickBox-Pro-2.1.8-Authenticated-RCE An authenticated low-privileged user can exploit a command injection vulnerability to get code-execution as www-data and escalate privileges to root due to weak sudo rules. QuickBox Pro v2.1.8 and prior is vulnerable...

CVE-2026-73570

CVE-2026-73570 — Zimbra ZCS SNMP Notification RCE exploit PoC Unauthenticated Remote Code Execution via OS Command Injection in the Zimbra Collaboration Suite SNMP notification handler. Overview...

CVE-2026-5615

CVE-2026-5615 — VvvebJs Cross-Site Scripting Almacenado RXSS Descripción general Este repositorio contiene un script de prueba de concepto PoC en Python que demuestra una vulnerabilidad de Cross-Site Scripting Almacenado RXSS que afecta a VvvebJs ⚠️ Este proyecto está destinado estrictamente a...

CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Framework modular para el estudio de una vulnerabilidad de escalada de privilegios LPE en Linux basada en técnicas de AFALG + Page Cache Injection. 🎯 Objetivo Este proyecto está diseñado para: Investigación de vulnerabilidades en kernel...

CVE-2026-31431-live-process-code-injection

CVE-2026-31431 Copy Fail — PoC de Inyección de Código en Procesos en Vivo Demuestra la ejecución arbitraria de código en un proceso en ejecución mediante la caché de páginas. por @secinfosex Qué hace: 1. Compila un binario de prueba: check return 42; en un bucle infinito 2. Lanza el proceso 3...

cve-2024-4577-lab

CVE-2024-4577 — Inyección de Argumentos en PHP-CGI → RCE Laboratorio Docker / CTF Un laboratorio Docker autónomo, desde cero , que demuestra la primitiva real de inyección de argumentos → Ejecución Remota de Código detrás de CVE-2024-4577. Explótalo a través de http://localhost:8080, obtén una...

CVE-2026-42167-PoC

Descripción Este repositorio contiene un exploit funcional para CVE-2026-42167. La falla existe en cómo modsql maneja ciertas variables de registro como %U, lo que permite a un atacante no autenticado inyectar comandos SQL a través del comando USER. Tipo de vulnerabilidad: Inyección SQL CWE-89...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...

poc-cpanel-cve-2026-41940

POC cPanel CVE-2026-41940 Una herramienta de auditoría de seguridad de alto rendimiento y multi-hilo diseñada para detectar CVE-2026-41940 , una vulnerabilidad crítica de Omisión de Autenticación en cPanel & WHM descubierta en abril de 2026. Esta herramienta aprovecha una técnica de Inyección CRL...

CVE-2026-41940

CVE-2026-41940 Auto Exploit Overview CVE-2026-41940 is a proof-of-concept PoC exploit targeting cPanel/WHM. This exploit demonstrates an unauthenticated authentication bypass using CRLF injection to leak security tokens and gain root-level access to the WHM interface, allowing for actions such as...

CVE-2026-41940-Exploit-PoC

CVE-2026-41940 Exploit PoC – cPanel & WHM Authentication Bypass Tool by: Ishan Oshada | GitHub ⚠️ FOR AUTHORIZED SECURITY TESTING ONLY. Unauthorized use is illegal. 📋 Table of Contents Vulnerability Overview Exploit Chain Features Installation Quick Start Usage Examples Post-Exploit Actions...

CVE-2026-56705

CVE-2026-56705: Adminer 5.4.3 — Unauthenticated RCE via MSSQL PDO DSN Injection...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms Fix A drop-in WordPress plugin that blocks the vulnerable Demo Import handler in FunnelForms Pro ≤ 3.8.1 to mitigate Remote Code Execution CVE-2026-39440, CVSS 9.9. The Vulnerability Field| Value ---|--- CVE ID| CVE-2026-39440 CVSS Score| 9.9 Critical Affected|...

CVE-2026-44590

CVE-2026-44590 - sherlock-project/sherlock CI - RCE via pullrequesttarget Injection → Supply Chain Compromise Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/sherlock-rce-pull-request-target-cve-2026-44590/ Upstream advisory: sherlock-project/sherlock GHSA advisory NVD...

CVE-2026-5027

CVE-2026-5027 - Langflow Path Traversal to Remote Code Execution Description Langflow versions up to and including 1.8.4 do not sanitize the filename parameter in the POST /api/v2/files endpoint. An attacker can use path traversal sequences ../ to write files to arbitrary locations on the...

cve-2026-64638-banner-poc

CVE-2026-64638 — Universal Banner PoC A single-file, dependency-free PoC generator for the WordPress CVE-2026-64638 reflected HTML-injection on wp-login.php striptags vs. KSES parser differential. It produces a self-submitting trigger page: when the victim opens the file, the page silently POSTs...

CVE-2026-1492

CVE-2026-1492 - WordPress User Registration Plugin Privilege Escalation Exploit Description This repository contains a proof-of-concept exploit for CVE-2026-1492 , a critical vulnerability affecting the WordPress User Registration & Membership plugin. The vulnerability allows unauthenticated...

CVE-2026-22038

CVE-2026-22038 — AutoGPT Stagehand Blocks Registran Claves API en Texto Plano ID CVE: CVE-2026-22038 Producto: Plataforma AutoGPT integración Stagehand Versiones afectadas: Todas las versiones hasta autogpt-platform-beta-v0.6.45 inclusive Corregido en: autogpt-platform-beta-v0.6.46 Tipo de...