Apache Tomcat Servers - Remote Code Execution

Apache Tomcat servers 7.0.0 to 79 are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to t...

PHPSHE 1.7 - SQL Injection

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication. id: CVE-2019-9762 info: name: PHPSHE 1.7 - SQL Injection author: DhiyaneshDK severity: critical description: | A SQL Injection was...

Micro Focus Operations Bridge Reporter - Remote Code Execution

Micro Focus Operations Bridge Reporter 10.40 is susceptible to remote code execution. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. id: CVE-2021-22502 info: name: Micro Focus...

MinIO Cluster Deployment - Information Disclosure

MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD. An attacker can potentially obtain sensitive...

UniFi OS - Authentication Bypass via Path Traversal (..%2f)

UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access. id: CVE-2026-34908 info: name: UniFi OS - Authentication Bypass via Path Traversal ..%2f...

CISA-KEV

CISA-KEV Zusammenfassung Dieses Repository bietet eine automatisierte Verfolgung und Analyse sowohl des CISA-KEV - als auch des VulnCheck-KEV -Katalogs, abgeglichen mit Nuclei-Sicherheitsvorlagen und öffentlichen Proof-of-Concept-Exploits. Durch die Integration von VulnCheck KEV erweitert sich di...

CVE-2025-20352

CVE-2025-20352 — Cisco IOS / IOS XE SNMP 栈溢出 由 Sentinel AI Defense 提供的研究报告。仅供防御性分析——此处未发布任何可用的漏洞利用或 PoC。 Cisco IOS 和 IOS XE 的 SNMP 子系统中存在基于栈的缓冲区溢出漏洞：精心构造的 SNMP 数据包发送至 UDP/161 可覆写栈，使未经身份验证的攻击者获得代码执行能力——直击网络核心。 📄 完整报告：https://sentinelaidefense.com/posts/cve-2025-20352-cisco-snmp-overflow.html 概述...

CVE-2026-72530-TrueConf-Sandbox-Escape-

CVE-2026-72530: TrueConf Server Sandbox Escape - Mitigação e Detecção PoC 📌 Descrição Geral Este repositório contém uma demonstração educacional da mitigação e detecção para CVE-2026-72530 , uma vulnerabilidade crítica de Code Injection e Sandbox Escape no TrueConf Server. Contexto da...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Framework-Toolkit di Exploit per il Bypass dell'Autenticazione SAML di Oracle WebLogic Server Oracle WebLogic — Bypass dell'Autenticazione SAML → Acquisizione dei Privilegi di Amministratore Framework di Exploit e Scanner di Massa Solo per test di sicurezza autorizzati. ⚖️...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - Framework d'exploitation RCE sans authentification ServiceNow & Vérificateur de PoC 🔥 ServiceNow AI Platform — Injection JavaScript → Évasion de sandbox → RCE → Élévation de privilèges root Framework d'exploitation et Vérificateur sécurisé Pour les tests de sécurité autorisés...

CVE-2026-15409-15410-Framework

1 CVE-2026-15409 | 2 CVE-2026-15410 SonicWall SMA1000 - SSRF → Erlang RCE → Root Privesc Framework di Exploit e Strumento di Rilevamento Sicuro Solo per test di sicurezza autorizzati. ⚖️ Disclaimer Legale e Uso Responsabile Questo strumento è fornito esclusivamente a scopo educativo e per test di...

cve-2026-63030_60137-wordpress_rce_reproduction

CVE-2026-63030 / CVE-2026-60137 — "wp2shell" WordPress Core RCE-Kette Entdecker: Searchlight Cyber via GPT-5.6 Sol Schweregrad: Kritisch — CVSS 9.8 CVE-2026-63030, CVSS 9.1 CVE-2026-60137 Status: Aktiv ausgenutzt — zu CISA KEV hinzugefügt Alias: "wp2shell" Übersicht Dies ist eine nicht...

fleet-cve-scanner

fleet-cve-scanner Uno scanner CVE open-source e a script singolo per flotte gestite tramite RMM. Puro PowerShell 7, senza agenti, senza appliance, senza costi di licenza. Risponde a una domanda per ogni software su ogni endpoint che gestisci: la versione installata è nota come vulnerabile e quant...

CVE-2026-72898

CVE-2026-72898 PoC : Iniezione SQL non autenticata in Metabase Iniezione SQL pre-autenticazione in Metabase che porta alla compromissione dell'admin Proof-of-concept per CVE-2026-72898, una vulnerabilità critica di SQL injection non autenticata nell'endpoint di reset della password di Metabase. I...

CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit

CVE-2026-50751 - Эксплойт обхода аутентификации Check Point IKEv1 ⚠️ ВАЖНОЕ ПРЕДУПРЕЖДЕНИЕ Этот код ТОЛЬКО для образовательных целей и авторизованных тестов безопасности. Неавторизованное использование против систем без явного разрешения НЕЗАКОННО. Автор не несет ответственности за неправильное...

CVE-2026-16232

CVE-2026-16232 — Bypass dell'autenticazione di Check Point SmartConsole PoC di bypass dell'autenticazione che consente di passare dall'accesso di rete non autenticato ai privilegi di amministratore completo. Un singolo file, solo libreria standard di Python 3, zero dipendenze. Sintesi della...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Pipeline a impatto zero che trasforma le CVE appena armamentizzate dal catalogo CISA Known Exploited Vulnerabilities KEV in regole di rilevamento Sigma pronte per la produzione, automaticamente, ogni settimana. Il problema Convertire manualmente una nuova voce K...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager में मनमानी फ़ाइल लेखन पथ ट्रैवर्सल -orange 📋 विवरण CVE-2026-20262 Cisco Catalyst SD-WAN Manager पहले SD-WAN vManage के वेब इंटरफ़ेस में पथ ट्रैवर्सल CWE-22 भेद्यता है। यह एक प्रमाणित हमलावर को लेखन अनुमतियों के साथ AnyConnect प्रोफ़ाइल अपलोड endpoint...

rxerium-templates

مجموعة مختارة من أكثر من 144 قالب Nuclei تركز على ثغرات اليوم صفر والثغرات المستغلة بنشاط في البرية مع بعض القوالب المتنوعة. تستخدم القوالب تقنيات اكتشاف سلبية مطابقة الإصدار/التاريخ وهي منظمة حسب السنة لسهولة التصفح. ⚠️ ملاحظة: قد تكون مطابقة التاريخ أقل موثوقية من اكتشاف الإصدار. استخدم بحذر. 📊...

CVE_Prioritizer

CVE Prioritizer CVE Prioritizer è un potente strumento che aiuta a prioritizzare la correzione delle vulnerabilità combinando CVSS, EPSS, le Vulnerabilità Note e Sfruttabili di CISA e le risorse community di VulnCheck NVD++, KEV. Fornisce preziose informazioni sulla probabilità di sfruttamento e...