CVE-2026-12269

Zohocorp ManageEngine DDI Central version 6.2.0 (builds below 6201) is vulnerable to a Keepalived configuration injection vulnerability within the HA configuration workflow. An authenticated operator-level user can exploit this flaw to modify the Keepalived configuration, potentially leading to R...

CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...

Exploit for CRLF Injection in Comfy Comfyui-Manager

CVE-2026-22777 — ComfyUI-Manager CRLF Injection → RCE with CV...

PT-2026-99957

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...

PT-2026-99959

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution RCE. Authentication...

openEQUELLA Deserialization / SSTI Remote Code Execution

openEQUELLA versions prior to 2026.1.0 contain authenticated remote code execution vulnerabilities involving unsafe Java deserialization and FreeMarker server side template injection. The deserialization issue allows an authenticated non-guest user to bypass a class denylist using a nested...

Exploit for CVE-2026-71963

CVE-2026-71963 — Hermes Agent RCE via a repository-delivered...

Exploit for CVE-2026-44011

CVE-2026-44011 Authenticated RCE in Craft CMS via Yii behavio...

CVE-2025-32432

CVE-2025-32432 — Craft CMS = 5.6.16 Unauthenticated RCE Severity: Critical CVSS 10.0 Auth required: None Affected: Craft CMS 3.0.0-RC1 - 3.9.14, 4.0.0-RC1 - 4.14.14, 5.0.0-RC1 - 5.6.16 Patched in: Craft CMS 3.9.15 / 4.14.15 / 5.6.17, Yii2 2.0.50 Identify How to Confirm the Target is Vulnerable...

Exploit for CVE-2026-44011

CVE-2026-44011-craft-rce-poc CVE-2026-44011-craft-rce-poc Usag...

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core · LFI → RCE Exploit no aute...

helpdeskz-file-upload-poc

HelpDeskZ File Upload RCE An unauthenticated arbitrary fil...

Exploit for CVE-2026-44011

CVE-2026-44011: Craft CMS authenticated RCE PoC This Python s...

cve-pocs

Security Research - Vulnerability Findings and Proof-of-Concep...

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core Unauthenticated Local File Inc...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RC...

CVE-2026-81655 Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to...

CVE-2026-81655

The Ad Inserter WordPress plugin (versions 2.8.12 through 2.8.18 ) is vulnerable to Remote Code Execution (RCE) and Stored Cross-Site Scripting (XSS) . The root cause is an improper access control restriction on a settings page, which is reachable by any logged-in user under specific configuratio...

Mida eFramework <=2.9.0 - Remote Command Execution

Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative root privileges. No authentication is required. id: CVE-2020-15920 info: name: Mida eFramework =2.9.0 - Remote Command Execution author: dwisiswant0 severity: critical description: Mida eFramewor...

Exchange Server - Remote Code Execution

Microsoft Exchange Server is vulnerable to a remote code execution vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. id: CVE-2021-34473 info: name: Exchange Server - Remote Code Execution author: arcc,intx0x80,dwisiswant0,r3dg33k severity: critical description: | Microsoft...