CVE-2026-0300-PANOS

CVE-2026-0300-PANOS 🔓 Unauthenticated Remote Code Execution RCE in Palo Alto Networks PAN-OS User-ID Portal 📋 Vulnerability Details Property| Value ---|--- CVE ID| CVE-2026-0300 Vulnerability Type| Unauthenticated Remote Code Execution Affected Component| Palo Alto Networks PAN-OS User-ID Portal...

CVE-2026-41044

CVE-2026-41044 Note: Educational Purposes Only From Advisory to RCA in an Afternoon: How AI Collapses N-Day Analysis A short, honest walkthrough of CVE-2026-41044 in Apache ActiveMQ using the exact pre and post patch code. CVE-2026-41044 was disclosed on April 24, 2026. It's a remote code executi...

CVE-2026-0300-POC

🛡️ CVE-2026-0300: PAN-OS User-ID™ Portal RCE Analysis Research Proof-of-Concept: CWE-787 Out-of-bounds Write 📌 Overview CVE-2026-0300 is a high-severity buffer overflow vulnerability identified in the Palo Alto Networks PAN-OS User-ID™ Authentication Portal Captive Portal. This research repository...

cve-2024-4577-lab

CVE-2024-4577 — PHP-CGI Argument Injection → RCE Docker Lab / CTF A self-contained, from-scratch Docker lab that demonstrates the real argument-injection → Remote Code Execution primitive behind CVE-2024-4577. Exploit it over http://localhost:8080, pop a shell, and read the flag from inside the...

CVE-2026-42167-PoC

CVE reported by ZeroPath Research original writeup: https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce my version : https://jimmexploit.vercel.app/cve/proftpd-unauthenticated-sql-injection-leads-to-rce Description This repository contains a functional exploit for...

ghes-cve-scanner

GHES CVE Scanner Detects whether GitHub Enterprise Server GHES instances are affected by CVE-2026-3854 and CVE-2026-4821. CVE Background CVE-2026-3854 CVSS 8.7 Git Push RCE — The babeld component does not sanitize semicolons in git push options, allowing remote code execution. Affected versions:...

CVE-2026-17532-lab

CVE-2026-17532 Lab - Seraphinite Accelerator: unauth XSS → 1-click RCE A Docker lab for CVE-2026-17532 , an unauthenticated reflected XSS in the WordPress plugin Seraphinite Accelerator that chains into remote code execution the moment a logged-in administrator opens one crafted link. Full writeu...

CVE-2026-42167

CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...

POC_CVE-2026-41940

POCCVE-2026-41940 Quick start python3 pocCVE-2026-41940.py -h Usage examples Scan one host python3 pocCVE-2026-41940.py -u https://target.example:2086 List accounts after successful chain python3 pocCVE-2026-41940.py -u https://target.example:2086 --action list Run a shell command python3...

cve-2026-2005

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow → RCE Remote code execution via a single SQL query targeting PostgreSQL's pgcrypto extension. The vulnerability is a heap buffer overflow in pgpparsepubencsesskey that allows corruption of PostgreSQL's internal MemoryContext allocator metadata,...

CVE-2026-42779

CVE-2026-42779 — Apache MINA Deserialization Filter Bypass to RCE CVSS 3.1: 9.8 CRITICAL AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-502 Deserialization of Untrusted Data Reporter: Venkatraman Kumar, Securin Advisory: Apache Mailing List Overview Apache MINA versions 2.1.0 through 2.1.11 and 2.2...

CVE-2026-10170-RCE

Visitor Management System 1.0 - SQLi to Remote Code Execution Attack Chain Vulnerability Information Field| Details ---|--- Product| Visitor Management System Vendor| code-projects.org Version| 1.0 Vulnerability Classes| SQL Injection CWE-89 + Unrestricted File Upload CWE-434 CVE ID| Pending CVSS...

cve-2026-41940-tool

🚀 CVE-2026-41940 – cPanel & WHM / WP Squared Auth Bypass Exploitation Tool A comprehensive Python utility to detect , scan in bulk , and exploit the critical authentication bypass vulnerability CVE-2026-41940 in cPanel & WHM and WP Squared. The tool combines multi‑port smart scanning,...

CVE-2026-21514_CVE-2026-21510

CVE-2026-21514 & CVE-2026-21510 Builders 1; CVE-2026-21514 SBX bypass or Protected View Bypass Rebuild document package with obfuscated path to WindowsUpdateDiagnostic.xml inside word/rels/webSettings.xml.rels Pending Check other xml configs in path C:\Windows\diagnostics\index if they support th...

CVE-2026-56705

CVE-2026-56705: Adminer dsn"sqlsrv:Server=$host" . $port ? ",$port" : "", $username, $password; Semicolons in server are treated as ODBC connection-attribute delimiters, so an unauthenticated attacker can append arbitrary attributes to the DSN — including TraceFile and TraceOn. The unixODBC trace...

CVE-2026-58073-check

Veeam Service Provider Console Agent Impersonation — Patch-State Detection Script A safe, unauthenticated detector for the KB4893 vulnerabilities in Veeam Service Provider Console published 2026-08-04. It answers one question per target, before any authentication or TLS: are the KB4893 fixes...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms Fix A drop-in WordPress plugin that blocks the vulnerable Demo Import handler in FunnelForms Pro ≤ 3.8.1 to mitigate Remote Code Execution CVE-2026-39440, CVSS 9.9. The Vulnerability Field| Value ---|--- CVE ID| CVE-2026-39440 CVSS Score| 9.9 Critical Affected|...

Research-CVE-2026-21858

CVE-2026-21858 Ni8mare: n8n Authentication Bypass & Remote Code Execution 1. OverviewVulnerability Name: Ni8mare CVE ID: CVE-2026-21858 CVSS Score: 10.0 Critical Vulnerability Type: Authentication Bypass, Local File Inclusion LFI, Remote Code Execution RCE Affected Versions: n8n versions 1.65.0 a...

CVE-2026-44590

CVE-2026-44590 - sherlock-project/sherlock CI - RCE via pullrequesttarget Injection → Supply Chain Compromise Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/sherlock-rce-pull-request-target-cve-2026-44590/ Upstream advisory: sherlock-project/sherlock GHSA advisory NVD...

Spring-Cloud-Function-SpEL

Spring-Cloud-Function-SpEL Visit my personal blog for details https://pizz33.github.io/ A test environment for Spring Cloud Function SpEL expression injection Version: Java 11. Start with java -jar demo-0.0.1-SNAPSHOT.jar Once set up, access port 127.0.0.1:8080 POST /functionRouter HTTP/1.1 Host:...