CVE-2014-2383-LFI-to-RCE-Escalation

CVE-2014-2383 LFI/RFI escalation to RCE Testing environment: dompdf 0.6.0 - php 7.3.33 - apache 2.4.25 During a security assessment the presence of CVE-2014-2383 was discovered. This document is a proof of concept and does not include the details from the initial discovery in order to protect...

cve-2022-32224-rails

CVE-2022-3222 ActiveRecord Serialization Behavior Verification https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 https://api.rubyonrails.org/classes/ActiveRecord/AttributeMethods/Serialization/ClassMethods.html...

CVE-2026-64638

XSS2Shell Alert PoC CVE-2026-64638 WordPress Pre-Auth Reflected XSS Proof of Concept Single-file HTML proof of concept for the CVE-2026-64638 XSS2Shell parser-differential XSS in WordPress Core. Demonstrates unauthenticated JavaScript execution in the WordPress origin via a crafted login request...

CVE-2026-48996

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...

GO-2025-3567 ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx

ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

RHEL 8 : Satellite 6.12.1 Async Security Update (Critical) (RHSA-2023:0261)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0261 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...

Reddit: Blind SSRF to internal services in matrix preview_link API

A vulnerability was found in the previewlink functionality of Matrix software used in Reddit's new chat system. The endpoint allowed for partially blind SSRF, enabling attackers to send GET requests and exfiltrate data about internal services. This could potentially lead to service enumeration an...