CVE-2021-21972

VMware vCenter Server RCE — CVE-2021-21972 研究实验室 作者：Niranjan Pokhrel 独立研究项目，在隔离的家庭实验室中复现并记录一个已公开披露的严重 VMware vCenter Server 漏洞，以理解漏洞类别、利用路径和防御缓解措施。 摘要 | ---|--- CVE| CVE-2021-21972 CVSSv3 基础评分| 9.8（严重） 厂商公告| VMSA-2021-0002 受影响产品| VMware vCenter Server 6.5 / 6.7 / 7.0 漏洞类别| 未认证任意文件上传 → 远程代码执行 状态| ...

remic

remic 用于检测应用程序依赖中公开披露的漏洞的漏洞扫描器 用法 root@kitploit: $ remic -h NAME: remic - A simple and fast tool for detecting vulnerabilities in application dependencies USAGE: remic options file VERSION: 0.0.2 OPTIONS: --format value, -f value format table, json default: "table" --severity value, -s value...

gha-lab-a7f6217d26

Artefacto de investigación automatizado — no es el proyecto original. Este repositorio es un laboratorio desechable construido por un sistema automatizado para una tesis de maestría en Université Laval sobre la reproducción de vulnerabilidades publicadas en flujos de trabajo de GitHub Actions. Es...

EUVD-2026-75213

A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoicebill.php of the component Invoice Generation. Such manipulation of the argument orderdate/invoiceno leads to...

Chrome-CVE-2024-2887-RCE-POC

Chrome-CVE-2024-2887-RCE-Poc概要 脆弱性名：Google Chrome Type Confusion 脅威タイプ：コード実行 悪用可能性：高 POC状態：公開済み 野中悪用状態：未公開 EXP状態：公開済み 技術詳細状態：公開済み This can be considered a variant bug of CVE-2024-2887 discovered by Manfred Paul and presented in Vancouver 2024. 注記...

EUVD-2026-74057

A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vaultunlockhandler/vaultrecoveryhandler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-86716 Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow

A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skipspacesandcomments of the file src/mjstok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The...

EUVD-2026-72932

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-86510

CVE-2026-86510 affects D-Link DIR-822A (firmware A_101) in the L2TP Control Message Parser component, specifically the tunnel_set_params function, where manipulation leads to an out-of-bounds write . The vulnerability is remotely exploitable with low privileges required and no user interaction, r...

EUVD-2026-72448

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...

CVE-2026-86319 java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...

CVE-2026-86310

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

EUVD-2026-72450

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

CVE-2026-86307

A cross-site request forgery (CSRF) vulnerability was identified in light0011 cms , affecting unknown code within commits c774dce and f72cf46. The attack is remotely initiated with low complexity and requires no authentication, but does require user interaction. Impact is limited to low integrity...

CVE-2026-86307 light0011 cms cross-site request forgery

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit...

CVE-2026-86296

A vulnerability was determined in D-Link DIR-822A A101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicl...

EUVD-2026-72336

A vulnerability was determined in D-Link DIR-822A A101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicl...

CVE-2026-86284

CVE-2026-86284 affects jaychouchannel Tourism-Management-System (a Java-based project hosted on GitHub). The vulnerable component is the getOption function in CommonController.java , where unsanitized tableName/columnName arguments enable remote, unauthenticated information disclosure (CVSS 3.1: ...

CVE-2026-79697

A command injection vulnerability in the basicstation_apply function of the Basic Station Certificate-Deletion Handler affects multiple Advantech WISE-6610 industrial gateway models (WISE-6610-NB, -EB, -TB, -JB, -CB, EL variants, and P-DEA/DNA/DTA) running firmware 1.2.1_20251110 . Manipulation o...

CVE-2026-86272

A vulnerability exists in Beijing Meite Software Technology U+Smart Enjoyment WebSite version 18.6001.1096.1000, specifically in the file /Report/Upload/UploadFormImg.ashx . An attacker can remotely manipulate the File argument to perform an unrestricted file upload , requiring no authentication ...