CVE-2025-47812

CVE-2025-47812 - Execução Remota de Código RCE no Wing FTP Server =========================================================== Autor: blindma1den Data: Julho de 2025 Tipo de Exploit: Execução Remota de Código Não Autenticado Alvo: Wing FTP Server 7.4.4 Pontuação CVSS: 10.0 Crítico DESCRIÇÃO Este...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Vulnerabilidade de execução remota de código não autenticada no Wing FTP Server = 7.4.3. Um byte NULL injetado no parâmetro username durante o login faz com que código Lua seja escrito no arquivo de sessão. Quando /dir.html é acessado com o cookie de sessão...

CVE-2009-2265

CVE-2009-2265 - Adobe ColdFusion 8 Upload de Arquivo com RCE Uma implementação em Rust do POC para o exploit CVE-2009-2265, visando Adobe ColdFusion 8. Visão Geral da Vulnerabilidade Esta vulnerabilidade permite que um atacante não autenticado faça upload de arquivos arbitrários para um diretório...

CVE-2025-47812

CVE-2025-47812 Este é um Prova de Conceito PoC do exploit do servidor Wing FTP CVE-2025-47812 Descrição As versões do Wing FTP Server anteriores a 7.4.4 sofreram de uma vulnerabilidade de Execução Remota de Código RCE como resultado do tratamento inseguro do parâmetro de nome de utilizador. Quand...

CVE-2019-17137

CVE-2019-17137 CVE जानकारी: https://vulners.com/cve/CVE-2019-17137 POC root@kitploit: GET /index.htm%00currentsetting.htm HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Accept: / Accept-Language:...

CVE-2014-6287

CVE-2014-6287 - Rejetto HTTP File Server RCE शोषण CVE-2014-6287 शोषण का एक Rust कार्यान्वयन जो Rejetto HTTP File Server HFS के संस्करण 2.3x 2.3c से पहले को लक्षित करता है। भेद्यता अवलोकन CVE-2014-6287 Rejetto HTTP File Server HFS में एक गंभीर दूरस्थ कोड निष्पादन भेद्यता है। तकनीकी विवरण प्रभावित...

CVE-2022-36804-POC

CVE-2022-36804-POC 🕷️ Execução remota de comandos não autenticada no Bitbucket CVE-2022-36804 Exploração Encontre repositórios publicamente visíveis - example.com/repos?visibility=public...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty , an asynchronous event-driven network framework, contains a validation bypass in its MqttEncoder prior to versions 4.1.137.Final and 4.2.17.Final . The encoder fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null by...

CVE-2025-47812-poc

CVE-2025-47812 Exploit de Execução Remota de Código RCE do Servidor FTP Wing CVE-2025-47812 📌 Crédito : Vulnerabilidade descoberta por Julien @MrTuxracer. Esta implementação de PoC é baseada na pesquisa original deles. Este repositório hospeda um exploit em Python para a vulnerabilidade de Execuç...

CVE-2025-58440

CVE-2025-58440 Laravel FileManager पर पॉलीग्लॉट फ़ाइल आक्रमण और नल बाइट इंजेक्शन के माध्यम से दूरस्थ कोड निष्पादन RCE अवलोकन unisharp/laravel-filemanager पैकेज के 2.11 संस्करण फ़ाइल अपलोड के दौरान अनुचित फ़ाइल प्रकार सत्यापन के कारण दूरस्थ कोड निष्पादन RCE के प्रति संवेदनशील हैं। यह भेद्यता हमलाव...

CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain input validation flaws in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders. The domain address and authentication (username/password) fields are no...

EUVD-2026-64272

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Execução Remota de Comandos RCE no Bitbucket Análise Técnica e Exploração Laboratorial de Injeção de Argumento Null-Byte Resumo da Vulnerabilidade CVE-2022-36804 é uma vulnerabilidade de Injeção de Argumento de nível alto/crítico na API REST do Atlassian Bitbucket Server e Data...

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Summary The free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse to...

EUVD-2026-51628

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...

CVE-2026-53551 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...