Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-

🚨 Vulnerability Report: CVE-2025-49113 in Roundcube Webmail ⚠️ IMPORTANT NOTICE — RESPONSIBLE USE This material is for educational and research purposes only. The use of the information and tools described here for any illegal or malicious activity is strictly prohibited. The author is not...

CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

CVE-2024-48705

Resumen Durante una reciente investigación de seguridad para el Wavlink AC1200 Modelo: WL-WN532A3, se identificó una vulnerabilidad de inyección de comandos posterior a la autenticación en el endpoint "/cgi-bin/adm.cgi". Esta vulnerabilidad podría permitir que actores malintencionados que hayan...

CVE-2019-19383

CVE-2019-19383 FreeFTPd 1.0.8 Post-Authentication Buffer Overflow via "SIZE" command. This exploit is published as-is for raising security awareness in the public interest, and educational purposes. Do not use this code for criminal activity...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB RCE post-autenticación mediante script de disparador JAVASCRIPT Ejecución remota de código posterior a la autenticación en ArcadeDB una base de datos Java multimodelo mediante un disparador JAVASCRIPT que accede a clases del host. El motor políglota de GraalVM de un...

CVE-2025-49113-nuclei-template

Plantilla de detección de vulnerabilidades de Nuclei - CVE-2025-49113 - Ejecución remota de código posterior a la autenticación en Roundcube ≤ 1.6.10 ID de CVE: CVE-2025-49113 Gravedad: Crítica CVSS 10.0 Descubierto por: Kirill Firsov FearsOff Fecha de divulgación: 1 de junio de 2025 Corregido en...

Webmin-CVE-2022-0824-revshell

Webmin-CVE-2022-0824-revshell Vulnerability Description Webmin 1.984 and below - File Manager privilege exploit CVE-2022-0824 and CVE-2022-0829 Less privileged Webmin users who do not have any File Manager module restrictions configured can access files with root privileges, if using the default...

CVE-2025-49113

CVE-2025-49113 – Roundcube Webmail RCE Exploit Python PoC CVE ID: CVE-2025-49113 Exploit Type: Remote Code Execution via PHP Object Injection Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10 Exploit Language: Python Author: 00xCanelo Status: Tested and Working on Vulnerable Roundcube...

CVE-2025-49113

CVE-2025-49113 Roundcube ≤ 1.6.10 RCE post-autenticación mediante deserialización de objetos PHP...

CVE-2024-9264

CVE-2024-9264 Grafana Post-Auth DuckDB SQL Injection RCE, File Read Proof of Concept PoC This PoC demonstrates the exploitation of CVE-2024-9264 using an authenticated user to perform a DuckDB SQL query and read an arbitrary file on the filesystem or execute arbitrary code remotely. Arbitrary cod...

PoC-RCE-Rukovoditel

PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CVE-2020-15946. Tested on Rukovoditel 2.4.x, 2.5.x and 2.6.1 Description: This exploit has two modes of execution, using the session fixation vulnerability CVE-2020-15946 or using the access credentials of any account under any profile...

DarkReplica

DarkReplica CVE-2026-23631 Redis Post-Auth RCE Exploit The full technical writeup can be found here: https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica...

CVE-2026-6837-zyxel-export-cgi-command-injection

CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection This repository packages the public writeup, quick verification script, and supporting evidence for CVE-2026-6837. What this is CVE-2026-6837 is a post-authentication command-injection flaw in Zyxel's export-cgi handler. On the...

FOISted

| / |/| | | | | | | | | || | | | | | | ||| | | || | | / / | | | | | | || | | || / | | || /|/ |, | FOISted: un jailbreak remoto para MikroTik Descripción FOISted es un exploit para dos vulnerabilidades posteriores a la autenticación en el RouterOS de MikroTik. Puede usarse para hacer jailbreak de...

Roundcube_CVE-2025-49113

RCE in Roundcube CVE-2025-49113 - My Obsidian note .md date time Status: Completed Lab: Easy Tags: RCE | PHP | LABTHM | EXPLOIT | CVE by KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script Impact : remote command execution post-login CVSS 9.9 Affected versions : ≤ 1.5.10 / 1.6.10 Patched : 1.5.1...

CVE-2021-27651

Sommario Un attaccante può aggirare tutte le fasi del flusso di reimpostazione della password e reimpostare la password dell'account di qualsiasi utente su Pega Infinity. Questo viene fatto 1 avviando il flusso di reimpostazione della password e inserendo l'email della vittima, quindi 2 forzando ...

CVE-2025-49113-Roundcube-RCE

CVE-2025-49113 — RCE Post-Autenticazione in Roundcube tramite Deserializzazione di Oggetti PHP Panoramica...

MAL-003

MAL-003: Bypass di Sicurezza Groovy e XSS Memorizzata in Apache OfBiz Sono stati identificati una RCE Groovy e una XSS in Apache OfBiz = 18.12.05. Perché nessuna CVE? Apache OfBiz non crea CVE per "attacchi post-autenticazione effettuati con credenziali demo, in particolare utilizzando l'utente...

CVE-2024-33911

The School Management 10.3.4 - SQL-Injection nach Authentifizierung Exploit-Titel: The School Management 10.3.4 - SQL-Injection nach Authentifizierung Datum: 29. April 2024 Exploit-Autor: Ivan Spiridonov xbz0n Hersteller-Website: https://theschool-management.com Version: 10.3.4 Getestet auf:...