PHP Vulnerability: CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

Linux Distros Unpatched Vulnerability : CVE-2026-113071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via...

cve-2023-30253

CVE-2023-30253 Description Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: ?PHP instead of ?php in injected data. Documentation CVE-2023-30253 GitHub Advisory: GHSA-9wqr-5jp4-mjmh Setup git clone...

CVE-2026-34197-Lab

CVE-2026-34197 — Apache ActiveMQ Classic Jolokia RCE Lab Overview This repository is a local Docker lab for studying CVE-2026-34197 , an Apache ActiveMQ Classic remote code execution issue reachable through the Jolokia JMX-HTTP API. The lab compares two ActiveMQ Classic instances side by side:...

CVE-2022-30190_EXP_PowerPoint

CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-30190 on PowerPoint. Modify the suffix of the file to 'zip' and unzip the file, you can edit \ppt\slides\rels\slide1.xml.rels and replace to your vps ip:port like this, then compress them as the same way and change the suffix to 'ppsx'. The...

CVE-2023-27524

CVE-2023-27524 Apache Superset Auth Bypass CVE-2023-27524 Reference https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/...

cve-2026-21877-rce

This repository does not have a README...

CVE-2021-41773

RCE exploit both for Apache 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013: IMHO only "special" setups will be vulnerable to this RCE. Same happens for the "arbitrary file read" exploits you have seen. Both CVEs are indeed almost the same path-traversal vulnerability 2nd one is the uncomplete fi...

cve-2020-11060-poc

CVE-2020-11060 This script is a Python 3.x based exploit for CVE-2020-11060 in GLPI versions 0.85-9.4.5. Original implementation: 0xdreadnaught Python3 refactoring: n3rada The original PoC in ExploitDB is now deprecated since it used Python 2.x. The new version has been submitted, and a link will...

CVE-2017-3241-POC

CVE-2017-3241-POC POC for java RMI deserialization vulnerability You probably need to use JDK 8 to run this poc. Just pay attention to Message class in both client and server side. They are different. And the difference is the key to understand this vulnerability. The fix Oracle published is to...

WSUS-RCE-Mitigation-59287

🚨 CRITICAL CYBERSECURITY ALERT: RCE in WSUS CVE-2025-59287 🚨 CREATOR AND CREDITS: @esteban11121 This guide has been created to help the community quickly mitigate the vulnerability. STATUS: Active Exploitation In-the-Wild Confirmed. This is a Remote Code Execution RCE vulnerability affecting WSUS...

CVE-2023-20887

CVE-2023-20887 Exploit VMWare vRealize Network Insight Pre-Authenticated RCE CVE-2023-20887 Usage usage: exploit.py -h -t TARGET -l LOCALHOST -p LOCALPORT optional arguments: -h, --help show this help message and exit -t TARGET, --target TARGET Target url, http://localhost:9000 -l LOCALHOST,...

CVE-2024-7985-PoC

CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload FileOrganizer Exploit - CVE-2024-7985 📌 Overview CVE-2024-7985 - WordPress Plugin FileOrganizer = 1.0.9 is vulnerable to authenticated arbitrary file uploads , allowing attackers with Subscriber+ privileges...

CVE-2026-113095

A flaw was found in chromium-browser. An out-of-bounds read vulnerability in the Focus component allows a remote attacker to execute arbitrary code within the browser's restricted environment sandbox. By convincing a user to visit a specially crafted HTML page, an attacker can trigger this memory...

CVE-2026-113092

A flaw was found in Google Chrome. A use-after-free vulnerability in the Passwords component allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a user to open a crafted HTML page. Because the application attempts to access memory after it has been released...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare - n8n RCE Full Chain Exploit 1. Executive Summary & Overview This document presents a deterministic technical reconstruction analysis of the CVE-2026-21858 vulnerability, internally...

SMB-LINUX-CVE-2025-37899

Use-After-Free Vulnerability in Linux Kernel's ksmbd CVE-2025-37899 Description A use-after-free vulnerability has been discovered in the ksmbd module of the Linux kernel, responsible for implementing the SMB Server Message Block protocol for network file sharing. This vulnerability, identified a...

PoC_CVE-2016-2098_Rails42

A PoC of CVE-2016-2098 rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb following command will cause remote code execution $ curl ':3000/poc/render1?template\inline='...

dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability

Improper control of generation of code 'code injection' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...