CVE-2024-4577

Vulnerabilidad de ejecución remota de código en PHP-CGI para Windows CVE-2024-4577 Introducción PHP es el acrónimo de Hypertext Preprocessor Preprocesador de Hipertexto, es un lenguaje de scripting de código abierto ampliamente utilizado, especialmente adecuado para el desarrollo web y la inserci...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Exploit de RCE en Pterodactyl Panel HTB Temporada 10 - Writeup de la máquina Pterodactyl Resumen Objetivo: Máquina Pterodactyl HTB Dificultad Media CVE: CVE-2025-49132 Gravedad: Crítica CVSS 9.8 Tipo de ataque: Ejecución remota de código no autenticada Afectado: Pterodactyl Panel...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Exploit RCE de Pterodactyl Panel HTB Temporada 10 - Writeup de la Máquina Pterodactyl Resumen Objetivo: Máquina Pterodactyl HTB Dificultad Media CVE: CVE-2025-49132 Severidad: Crítica CVSS 9.8 Tipo de Ataque: Ejecución Remota de Código No Autenticada Afectado: Pterodactyl Panel...

CVE-2025-49132-Pterodactyl-Panel-RCE

CVE-2025-49132 — Panel de Pterodactyl Investigación de Seguridad y Análisis Educativo Resumen Este proyecto documenta la investigación relacionada con CVE-2025-49132 , una vulnerabilidad que afecta al Panel de Pterodactyl. Propósito: Investigación de seguridad, educación, conciencia defensiva Usa...

HTB-Pterodactyl-RCE-CVE-2025-49132

Pterodactyl Panel Locale RCE CVE-2025-49132 — Educational PoC -6f42c1 For authorized testing and defensive learning only. This repository is intended for controlled lab environments e.g., CTF/HTB-style setups where you own the target or haveexplicit written permission to test it. Context This...

POC-CVE-2024-38820

CVE-2024-38820 Prueba de Concepto Resumen Este proyecto demuestra CVE-2024-38820 , una vulnerabilidad en DataBinder de Spring Framework que permite omitir la protección disallowedFields debido a problemas de conversión de mayúsculas/minúsculas dependientes de la configuración regional. Detalles d...

CVE-2025-49132

CVE-2025-49132 Proof of Concept PoC This repository contains a Proof of Concept PoC for CVE-2025-49132, a critical unauthenticated remote code execution RCE vulnerability in Pterodactyl Panel versions prior to 1.11.11. Vulnerability Details CVE ID : CVE-2025-49132 Severity : 10.0 Critical -...

CVE-2026-84939

A flaw was found in Apache FreeMarker. A remote attacker could exploit a path traversal vulnerability in the template loading mechanism by providing a specially crafted, malformed locale identifier. This is possible if the localized lookup configuration setting is enabled, which is the default...

keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.16 Security Update

New Red Hat build of Keycloak 26.4.16 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.16 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651 Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651 Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

EUVD-2026-80830

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

CVE-2026-79651

CVE-2026-79651 is an unauthenticated denial-of-service vulnerability in the keycloak-services component of Keycloak, specifically in its theme localization endpoints . The root cause is that the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-m...

CVE-2026-79651

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...

Directory Traversal

Overview moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of this package are vulnerable to Directory Traversal in the locale function, whose locale name validation is circumvented by a non-string value, so an object ca...

Directory Traversal

Overview org.webjars.npm:moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of this package are vulnerable to Directory Traversal in the locale function, whose locale name validation is circumvented by a non-string value,...

CVE-2026-17495

A flaw was found in moment, a JavaScript library for handling dates. A remote attacker could exploit this vulnerability by providing a specially crafted input to the moment.locale function. This input, which is not a standard text string, can bypass security checks designed to prevent unauthorize...