CVE-2025-10035

CVE-2025-10035 — RCE da deserializzazione nel License Servlet di Fortra GoAnywhere MFT Rapporto di ricerca di Sentinel AI Defense. Solo analisi difensiva — nessun exploit funzionante o PoC viene pubblicato qui. Una catena di deserializzazione perfetta 10/10 in Fortra GoAnywhere MFT: una firma...

Vulnerability-scanner

Con la crescente dipendenza delle organizzazioni dalle tecnologie digitali per la comunicazione, l'archiviazione dei dati e le operazioni aziendali, le minacce alla sicurezza informatica sono aumentate in modo significativo. Considerato il ruolo fondamentale che il software di sicurezza degli...

CVE-2025-8875-CVE-2025-8876

CVE-2025-8875 & CVE-2025-8876 Come funziona questo metodo di rilevamento? Template di rilevamento versione – qualsiasi installazione con versione 2025.3.1.9 o precedente è considerata vulnerabile a CVE-2025-8875 e CVE-2025-8876 Come eseguire questo script? 1. Scarica Nuclei da qui 2. Copia il...

fortra-goanywhere-mft-vulnerability-detection

Rilevamento delle Vulnerabilità di Fortra GoAnywhere MFT Modelli Nuclei per il rilevamento delle vulnerabilità di Fortra GoAnywhere MFT. Creato da@rxerium Panoramica Modelli di rilevamento CVE per Fortra GoAnywhere Managed File Transfer MFT, incluse diverse vulnerabilità CISA KEV sfruttate da...

CVE-2026-72898-metabase-sqli

CVE-2026-72898 — Injeção SQL não autenticada no Metabase detector + análise -black Injeção SQL não autenticada no Metabase via POST /api/session/resetpassword. CVSS 10.0 , no catálogo CISA KEV, explorada ativamente. Um campo não declarado no corpo da solicitação de redefinição de senha chega à...

cve-2026-31431

CVE-2026-31431 — "Copy Fail": Escalatione dei Privilegi Locali nel Kernel Linux algifaead CISA KEV | CVSS 7.8 ALTO | Interessa i kernel Linux 4.14 – inizio 2026 9 anni Indice 1. Sintesi Esecutiva 2. Valutazione del Rischio 3. Analisi Tecnica Approfondita 4. Metodologia di Attacco — Red Team 5...

Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-Data

Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-Data CVE‑2026‑20805: Uma falha no Windows Desktop Window Manager que causa divulgação local de informações. Requer privilégios baixos, sem interação do usuário. Classificada com CVSS 5.5 Média. Explorada ativamente e listada no CISA...

CVE-2026-21509-PoC

CVE-2026-21509 — Pädagogischer Dummy-PoC für Defender-Sichtbarkeit ⚠️ Dieses Repository stellt einen harmlosen, nicht-exploitativen Proof of Concept bereit. Sein Zweck ist die Unterstützung von defensiver Forschung , EDR/AV-Sichtbarkeitstests und Schulungen. Es exploitiert CVE‑2026‑21509 nicht und...

CVE-2023-49103

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Wir fordern die sichere Rückkehr aller Bürger, die von der terroristischen Gruppe Hamas als Geiseln genommen wurden. Wir werden nicht ruhen, bis jede Geisel freigelassen und sicher nach Hause zurückgekehrt ist. Sie können helfen, sie nach Hause zu...

CVE-2025-24990

CVE-2025-24990 — विंडोज अनट्रस्टेड पॉइंटर डीरेफरेंस EoP सेंटिनल एआई डिफेंस द्वारा शोध लेख। केवल रक्षात्मक विश्लेषण — यहाँ कोई कार्यशील एक्सप्लॉइट या PoC प्रकाशित नहीं किया गया है। एक विशेषाधिकार प्राप्त विंडोज घटक किसी अविश्वसनीय संदर्भ से प्राप्त पॉइंटर को सत्यापित किए बिना डीरेफरेंस करता है —...

Atlassian Jira Server-Side Template Injection

Jira Server and Data Center is susceptible to a server-side template injection vulnerability via the ContactAdministrators and SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and...

QNAP QTS and Photo Station 6.0.3 - Remote Command Execution

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. id: CVE-2019-7192 info: name: QNAP QTS and Photo Station 6.0.3 - Remote Command Execution...

WordPress Social Warfare <3.5.3 - Cross-Site Scripting

WordPress Social Warfare plugin before 3.5.3 contains a cross-site scripting vulnerability via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, affecting Social Warfare and Social Warfare Pro. id: CVE-2019-9978 info: name: WordPress Social Warfare 3.5.3 - Cross-Site Scripting...

Tenda Router AC11 - Remote Command Injection

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-31755 info: name: Tenda Router AC11 - Remote Comman...

WP Hotel Booking < 1.10.4 - PHP Object Injection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. id: CVE-2020-29047 info: name: WP Hotel Booking 1.10.4 - PHP Object...

Mingsoft MCMS v5.2.7 - SQL Injection

Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server. id: CVE-2022-26585 info: name: Mingsoft MCMS v5.2.7 - SQL Injection author: ritikchaddha severity: critical...

PHPSHE 1.7 - SQL Injection

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication. id: CVE-2019-9762 info: name: PHPSHE 1.7 - SQL Injection author: DhiyaneshDK severity: critical description: | A SQL Injection was...

Micro Focus Operations Bridge Reporter - Remote Code Execution

Micro Focus Operations Bridge Reporter 10.40 is susceptible to remote code execution. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. id: CVE-2021-22502 info: name: Micro Focus...

MinIO Cluster Deployment - Information Disclosure

MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD. An attacker can potentially obtain sensitive...

UniFi OS - Authentication Bypass via Path Traversal (..%2f)

UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access. id: CVE-2026-34908 info: name: UniFi OS - Authentication Bypass via Path Traversal ..%2f...