PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration Il plugin per WordPress Migration, Backup, Staging – WPvivid Backup & Migration è vulnerabile al caricamento arbitrario di file non autenticato nelle versioni fino alla 0.9.123 inclusa. Ciò è dovuto a una gestione impropria degli errori nel processo d...

CVE-2025-47812

CVE-2025-47812 - Execução Remota de Código RCE no Wing FTP Server =========================================================== Autor: blindma1den Data: Julho de 2025 Tipo de Exploit: Execução Remota de Código Não Autenticado Alvo: Wing FTP Server 7.4.4 Pontuação CVSS: 10.0 Crítico DESCRIÇÃO Este...

CVE-2019-11043

CVE-2019-11043 Execução Remota de Código em PHP-FPM Screencast: https://youtu.be/d6benC5FVZM Visão Geral Este exploit de zero-day em configurações comuns de PHP-FPM foi descoberto durante a competição Realworld CTF em 2019. Uma expressão regular é usada para analisar a URI solicitada, mas...

CVE-2023-1177

CVE-2023-1177 | | MLFlow Pfad-Traversal | Getestet auf MLflow 2.2.0 | Quelle: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server RCE non autenticato riscrittura Exploit Python per la RCE tramite injection Lua non autenticata in Wing FTP Server ≤ 7.4.3. Progettato per la consegna di shell — un comando da check a un callback netcat funzionante. Scritto qualche tempo fa per il lab wingData su...

Blackash-CVE-2025-47812

🛡️ CVE-2025-47812 – RCE Critico in Wing FTP Server 🛡️ 🔎 Panoramica: CVE-2025-47812 è una vulnerabilità critica di esecuzione remota di codice RCE che colpisce Wing FTP Server versioni precedenti alla 7.4.4. È stata scoperta da un ricercatore di sicurezza ed è stata confermata come attivamente...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bison (UTSA-2026-093642)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093642 advisory. GNU Bison before 3.7.1 has a use-after-free in obstackfree in lib/obstack.c called from gramlex when a '\0' byte is encountered. NOTE: there is a risk only if Bison ...

System-Velocity

System-Velocity Proxy-level security and maintenance for Veloci...

Wazuh Server 1.0.0 < 4.14.6 Out-of-Bounds Write (CVE-2026-44254)

The version of Wazuh Server on the remote host is at least 1.0.0 and prior to 4.14.6. It is, therefore, affected by an out-of-bounds write vulnerability: - HandleSecureMessage passes a pointer inside its stack buffer to ReadSecMSG, which decompresses up to OSMAXSTR bytes at that offset. An...

DEBIAN-CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty , an asynchronous event-driven network framework, contains a validation bypass in its MqttEncoder prior to versions 4.1.137.Final and 4.2.17.Final . The encoder fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null by...

CVE-2025-47812-poC

CVE-2025-47812-poC Wing FTP Server RCE CVE-2025-47812 के लिए सरल शोषण जो कमांड चलाने और रिवर्स शेल प्राप्त करने के लिए है। केवल शैक्षिक उपयोग के लिए। भेद्यता विवरण यह सुरक्षा भेद्यता RCESecurity https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ द्वारा सार्वजनिक...

CVE-2025-47812-poc

CVE-2025-47812 Exploit di Remote Code Execution RCE per Wing FTP Server CVE-2025-47812 📌 Crediti : Vulnerabilità scoperta da Julien @MrTuxracer. Questa implementazione del PoC si basa sulla loro ricerca originale. Questo repository contiene un exploit Python per la vulnerabilità di Remote Code...

Null Byte Interaction Error (Poison Null Byte)

Overview Affected versions of this package are vulnerable to Null Byte Interaction Error Poison Null Byte via the Socks4ClientEncoder and Socks5ClientEncoder in codec-socks. An attacker can truncate or alter encoded SOCKS requests by supplying userId, destination host, username, or password value...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.1.x through 4.1.136.Final and 4.2.0.Final through 4.2.16.Final contain null byte and CRLF injection vulnerabilities in the Socks4ClientEncoder and Socks5ClientEncoder . The encoders fail to validate domain address and authentication (username/password...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

EUVD-2026-64272

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...