CVE-2026-86131

A code injection vulnerability exists in the WatchGuard Fireware OS during the handling of BOVPN Over TLS client configurations. This flaw allows an attacker who controls a remote VPN server to execute arbitrary commands with root privileges on the connecting Firebox . No specific patch versions ...

CVE-2026-13046

A deserialization of untrusted data vulnerability exists in the SAML single sign-on session handling (samld) component of WatchGuard Fireware OS . An attacker who has already successfully obtained the ability to write files on the appliance can execute arbitrary code in the context of the samld s...

CVE-2026-81433 Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution

A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon fingerd allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet...

CVE-2026-18145 Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the spamBlocker spamd service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request...

CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox...

CVE-2026-18145

The WatchGuard Fireware OS contains a stack-based buffer overflow vulnerability within the spamBlocker (spamd) service. An authenticated attacker possessing administrator privileges can exploit this flaw by sending a specially crafted management request. Successful exploitation could result in a ...

CVE-2026-13046 Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling samld allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a...

DocViewerExploitApp

DocViewerExploit App - CVE-2021-40724 This is the source code to exploiting the Document Viewer by MobileHackingLab. About the Vulnerable App This is an exploit app for the MobileHackingLab DocumentViewer Abdroid App Dynamic Code Loading RCE challenge. This challenge emulates CVE-2021-40724...

CVE-2022-29465

CVE-2022-29464 go run main.go 请输入目标地址, 如 https://127.0.0.1 https://127.0.0.1:9443 https://127.0.0.1:9443/authenticationendpoint/cmd.jsp?cmd=id...

Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-

🚨 Vulnerability Report: CVE-2025-49113 in Roundcube Webmail ⚠️ IMPORTANT NOTICE — RESPONSIBLE USE This material is for educational and research purposes only. The use of the information and tools described here for any illegal or malicious activity is strictly prohibited. The author is not...

CVE-2018-7600

CVE-2018-7600 - Drupal 7 Remote Code Execution A Rust implementation of the CVE-2018-7600 exploit targeting vulnerable Drupal 7 installations = 7.57. This CLI reproduces this following PoC flow: it poisons a cached renderable form via the user/password path, extracts a formbuildid, then triggers...

tivoli-poc

tivoli-poc Código PoC de CVE-2017-1635 CVEID: CVE-2017-1635 Puntuación base CVSS: 8 Productos y versiones afectados: componente KDH de IBM Tivoli Monitoring Basic Services KGL,KAX para las versiones 6.2.2.0 a 6.2.2.9 Existe una vulnerabilidad en el servidor web interno proporcionado por los...

relatorio-n8n.md

TryHackMe Report — n8n: CVE-2025-68613 Vulnerability: CVE-2025-68613 Publication: 19/12/2025 CVSS: 9.9 Critical Summary Report on the exploitation and analysis of the expression injection vulnerability in n8n that allows remote code execution RCE. Documents the environment, steps, tested payloads...

CVE-2024-10914

CVE-2024-10914 - D-Link Remote Code Execution RCE Exploit This script is a proof-of-concept PoC exploit for CVE-2024-10914, a remote code execution vulnerability in certain D-Link devices. The script identifies and exploits vulnerable devices to execute arbitrary commands. Note: This script shoul...

CVE-2026-103041

LightLLM versions through 1.2.0 in multimodal deployments are vulnerable to Remote Code Execution (RCE) . The flaw exists because an unauthenticated RPyC cache service is exposed on all interfaces with pickle deserialization enabled. An attacker can send crafted serialized objects to the exposed ...

CVE-2026-103040

LightLLM versions through 1.2.0 are vulnerable to remote code execution (RCE) within the router profiler service when the --enable_profiling flag is used. The root cause is the exposure of an unauthenticated RPyC server with pickle deserialization enabled. This allows an attacker to execute arbit...

CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

CVE-2026-103041 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

CVE-2026-103041 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

CVE-2026-103041 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...