THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287 Credits I take no credit for the original discovery and exploitation of this vulnerability. Thank you to the following people! Discovery: Daniele Linguaglossa Metasploit Module...

CVE-2014-6287

CVE-2014-6287 - Rejetto HTTP File Server RCE Exploit A Rust implementation of the CVE-2014-6287 exploit targeting Rejetto HTTP File Server HFS versions 2.3x before 2.3c. Vulnerability Overview CVE-2014-6287 is a critical remote code execution vulnerability in Rejetto HTTP File Server HFS. Technic...

CVE-2009-2265

CVE-2009-2265 - Adobe ColdFusion 8 Subida de Archivos RCE Una implementación en Rust del POC para el exploit CVE-2009-2265, dirigida a Adobe ColdFusion 8. Resumen de la Vulnerabilidad Esta vulnerabilidad permite a un atacante no autenticado subir archivos arbitrarios a un directorio accesible des...

Orbit-Fox_SSRF_CVE-2025-10874

CVE-2025-10874 - Orbit Fox SSRF Proof of Concept Proof of concept exploit demonstrating Server-Side Request Forgery SSRF vulnerability in the Orbit Fox WordPress plugin with null byte injection bypass. Detailed blog post: https://ryanmroth.com/articles/orbit-fox-ssrf Vulnerability Details...

PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process...

CVE-2026-22356

CVE-2026-22356: Vulnerabilidad de Path Traversal y RCE en Jetpack CRM Advertencia: Esta herramienta debe utilizarse únicamente en entornos de prueba autorizados. El usuario es totalmente responsable del uso ilegal. 📥 Requisitos root@kitploit: pip3 install requests urllib3 $ python3 exploit.py...

CVE-2025-58440

CVE-2025-58440 Remote Code Execution RCE via Polyglot File Attack and Null Byte Injection on Laravel FileManager Overview The unisharp/laravel-filemanager package versions 2.11 are vulnerable to Remote Code Execution RCE due to improper file type validation during file uploads. The vulnerability...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python exploit for the unauthenticated Lua-injection RCE in Wing FTP Server ≤ 7.4.3. Designed for shell delivery — one command from check to a working netcat callback. Written some time ago for wingData lab on HTB and open-sourced now. Use only...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bison (UTSA-2026-093642)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093642 advisory. GNU Bison before 3.7.1 has a use-after-free in obstackfree in lib/obstack.c called from gramlex when a '\0' byte is encountered. NOTE: there is a risk only if Bison ...

System-Velocity

System-Velocity Proxy-level security and maintenance for Veloci...

Wazuh Server 1.0.0 < 4.14.6 Out-of-Bounds Write (CVE-2026-44254)

The version of Wazuh Server on the remote host is at least 1.0.0 and prior to 4.14.6. It is, therefore, affected by an out-of-bounds write vulnerability: - HandleSecureMessage passes a pointer inside its stack buffer to ReadSecMSG, which decompresses up to OSMAXSTR bytes at that offset. An...

DEBIAN-CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty , an asynchronous event-driven network framework, contains a validation bypass in its MqttEncoder prior to versions 4.1.137.Final and 4.2.17.Final . The encoder fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null by...

CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

Astra Linux – Vulnerability in PHP 8.1, PHP 7.3

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, and 8.3. before 8.3.5, if a password stored using passwordhash starts with a null byte \x00, testing a blank string as the password via passwordverify will incorrectly return true...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak did not properly validate whether the permissions displayed to the user during installation match the actual permissions granted to the app at runtime, especially when there was a nu...

Null Byte Interaction Error (Poison Null Byte)

Overview Affected versions of this package are vulnerable to Null Byte Interaction Error Poison Null Byte via the Socks4ClientEncoder and Socks5ClientEncoder in codec-socks. An attacker can truncate or alter encoded SOCKS requests by supplying userId, destination host, username, or password value...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...