CVE-2023-20209

I started looking at Cisco Expressway after I noticed quite a few of them on the internet during Red Team engagements, but never had the time during work to explore the product further. Initially I was looking for an auth bypass to chain into RCE but ran out of time and settled on a post auth RCE...

CVE-2019-20224

CVE-2019-20224 The offical exploit for Pandora v7.0NG Post-auth Remote Code Execution CVE-2019-20224...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 RCE posterior a la autenticación Superadmin Descripción de la Vulnerabilidad Crater Invoice es vulnerable a la subida de archivos sin restricciones con tipos peligrosos debido a la falta de validación adecuada de entrada. La clase de...

CVE-2020-8813

CVE-2020-8813 The official exploit for Cacti v1.2.8 Remote Code Execution CVE-2020-8813 Cacti v1.2.8 Pre-Auth Remote Code Execution Cacti v1.2.8 Post-Auth Remote Code Execution...

OWASSRF-CVE-2022-41082-POC

CVE-2022-41082-POC 针对影响 Microsoft Exchange 服务器的 CVE-2022-41082 NotProxyShell OWASSRF 漏洞的 PoC 这是 ProxyNotShell OWASSRF 的认证后 RCE，需要有效的凭据才能执行命令。 添加了用于 TabShell 漏洞（CVE-2022-41076）的 Powershell PoC 脚本 TabShell 漏洞是一种权限提升形式，允许在通过 OWASSRF 成功获得访问权限后突破受限的 Powershell 沙盒。 受影响版本 Exchange 2013、16、19 直到...

CVE-2019-11539

CVE-2019-11539 Original Discovery: Orange Tsai, Meh Chang Authors: Justin Wagner, Alyssa Herrera Thanks to: Orange, Meh Chang, Rich Warren, Alyssa, Mimir Vulnerability Description In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and...

CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift Vulnerability Details Vulnerability as seen in HackTheBox - SwagShop Stage 1 = exploit.py Gain administrator credentials to Magento CMS dashboard Stage 2 = postauth.py With credentials gained from exploit.py added to postauth.py run: root@kitploit: python3 postauth....

CVE-2022-41082-POC

CVE-2022-41082-POC PoC for the CVE-2022-41082 NotProxyShell OWASSRF Vulnerability Effecting Microsoft Exchange Servers This is Post-Auth RCE for ProxyNotShell OWASSRF, valid cardentials are needed for command execution. Added the Powershell PoC script for TabShell Vulnerability CVE-2022-41076 The...

CVE-2026-73489 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpys copies a rule token into temp1rule1 25-byte destination or temp2/temp3 16-byte destination, the code unconditionally writes a N...

JetBrains TeamCity <= 2025.11.4 Privilege Escalation (CVE-2026-44413)

The version of JetBrains TeamCity installed on the remote host is 2025.11.4 or prior. It is, therefore, affected by a post-authentication privilege escalation vulnerability that may allow any authenticated user, including standard or guest accounts, to expose some parts of the TeamCity server API...

EUVD-2026-23519

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication...

DEBIAN-CVE-2026-23943

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2026-23943 Pre-auth SSH DoS via unbounded zlib inflate

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...

CVE-2024-48705

Wavlink AC1200 with firmware versions M32A3V1410230602 and M32A3V1410240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "setsysadm" function of the "adm.cgi" binary, and is due to improper santization ...

VulnCheck KEV: CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletewlanprofile...

CVE-2025-49218

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute...

Fedora 42 : roundcubemail (2025-70701de9de)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-70701de9de advisory. This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: Fix Post-Auth RCE...