CVE-2026-53753-Crawl4AI-RCE

CVE-2026-53753 — Crawl4AI Ejecución Remota de Código No Autenticada Evasión de Sandbox AST RCE previa a la autenticación en Crawl4AI.read — devolviendo la salida del comando en banda en la respuesta JSON...

CVE-2026-7275-moodle

CVE-2026-7275-moodle PoC y documentación para CVE-2026-7275 : Moodle Google Drive Repository repositorygoogledocs — Path Traversal / Arbitrary File Write que puede conducir a RCE en versiones de Moodle sin parchear. Disclaimer: Solo para investigación de seguridad autorizada, auditoría y educació...

CVE-2023-26039

CVE-2023-26039 Description ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl in /web/api/app/Controller/HostController.php. A...

yaml-payload

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

mcpjam-to-root

⚠️ Disclaimer This repository is intended for authorized security research, penetration testing, and educational purposes only. Do not use the techniques described here against systems without explicit authorization. ⚡ MCPJam → Root From MCPJam Inspector RCE to root — CVE-2026-23744, JupyterLab...

CVE-2025-24893

XWiki SSTI Exploit A Python exploit for XWiki Server-Side Template Injection SSTI vulnerability via Groovy template injection in the SolrSearch endpoint. Vulnerability Type : Server-Side Template Injection SSTI Component : XWiki SolrSearch RSS feed Impact : Remote Code Execution Affected Version ...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.69 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.69 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2024-27954

⚠️ CVE-2024-27954 💀 Herramientas Automáticas de Explotación de Ejecución Remota de Código | Por GhostSec 💀 📝 Descripción Limitación incorrecta de una ruta de acceso a un directorio restringido vulnerabilidad de 'Path Traversal' en WP Automatic Automatic permite salto de ruta 'Path Traversal' y...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.68 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.68 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

ci_fuzz

Description: root@kitploit: This script fuzz's for Command Injection vulnerabilities resulting in remote command execution. Similiar OWASP vulnerablities are explained here -- https://www.owasp.org/index.php/CommandInjection The script will attempt to execute OS commands by injecting into every...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Update 31/05/2022 - CVE-2022-30190 - Follina Now the generator is able to generate the document required to exploit also the "Follina"...

CVE-2026-40473

camel-mina MinaConverter.toObjectInput Unsafe Deserialization Reproducer CVE-2026-40473 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-mina component, tracked as CVE-2026-40473. The MinaConverter.toObjectInputIoBuffer type converter wraps the received bytes...

CVE-2026-40859

camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deserialization Reproducer CVE-2026-40859 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-netty-http and camel-vertx-http components, tracked as CVE-2026-40859. When a producer endpoint is configured...

CVE-2026-20841

🛡️ CVE-2026-20841 - Windows Notepad Security Test Tool ⚠️ What is CVE-2026-20841? CVE-2026-20841 is a known security weakness in the Windows Notepad application. It affects the markdown feature, which lets Notepad display formatted text with clickable links. This weakness happens because the...

CVE-2025-6335

Title: Template injection command execution vulnerability in dedeCMS 5.7 sp2 BUGAuthor: Ewoji Affected Version: dedeCMS 5.7.2 Vendor: Shanghai Zhuozhuo Network Technology Co., LTD Software: dedeCMS Vulnerability Files: /include/dedetag.class.php Description: 1. After install，Log in to the...

CVE-2026-33017

CVE-2026-33017 - RCE no autenticado en Langflow ⚠️ AVISO: Este repositorio es solo para pruebas de seguridad autorizadas y fines educativos. Úselo solo en sistemas de su propiedad o para los que tenga permiso explícito. El autor no se hace responsable del mal uso o daños causados por esta...

CVE-2025-47227

CVE-2025-47227 Exploit for CVE-2025-47227 - ScriptCase Password Reset Pre-Auth CVE-2025-47227 is a pre-auth authentication bypass CVSS 9.8 in the ScriptCase Production Environment ≤ 9.12.006. The login.php endpoint allows resetting the administrator password without a token, email validation, or...

CVE-2025-52970

CVE-2025-52970 Exploit de omisión de autenticación de FortiWeb a ejecución remota de código Características Armado añadiendo un shell interactivo para permitir la ejecución remota de código Uso root@kitploit: python CVE-2025-52970.py -t target.com Demostración Referencias...

CVE-2026-40048

camel-pqc FileBasedKeyLifecycleManager 안전하지 않은 역직렬화 재현기 CVE-2026-40048 이 프로젝트는 Apache Camel의 camel-pqc 컴포넌트에서 CVE-2026-40048 로 추적되는 Java 역직렬화 취약점 을 시연합니다. FileBasedKeyLifecycleManager는 구성된 키 디렉터리에서 .key 파일을 ObjectInputFilter 없이 원시 ObjectInputStream으로 읽으므로, 해당 디렉터리에 쓰기 권한이 있는 공격자는 원격 코드 실행 을 달성할 수...

CVE-2024-47051

Summary Bad sanitization of uploaded file's content, type and extension in the Asset Edition feature allows an authenticated attacker to write arbitrary PHP code inside the web directory and locate where said file is written. This results in Remote Code Execution. A path traversal also allows to...