EUVD-2026-92043

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system (CMS) like 1C-Bitrix. This feature allows unauthorized users to execute arbitrary code by enabling unlimited uploading of dangerous types of files.

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the CodeScoring software development platform lies in its inability to eliminate special elements from the template creation mechanism, allowing attackers to execute arbitrary code.

The vulnerability of the CodeScoring software development platform lies in the lack of measures to neutralize special elements within the template creation mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system, which stems from the lack of authentication for a critical function, allows attackers to execute arbitrary code.

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the VoIP gateway software Telecom MG, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the VoIP gateway software of Telecom MG is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the FOQUZ platform, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary code.

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the CrocoTime employee working time management system, related to the lack of measures taken to protect the website structure, allows a perpetrator to execute arbitrary codes.

The vulnerability in the CrocoTime employee working hours tracking system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

CVE-2024-22891

Nteract PoC Une preuve de concept pour la vulnérabilité CVE-2024-22891. nteract 0.28.0 permet une vue web Electron via un lien Markdown, avec une exécution de code à distance résultante. Dans ce dépôt se trouve un exemple d'application vulnérable et une exploitation de preuve de concept POC de...

CVE-2022-26134

pip3 install -r requirements.txt utilisation: python3 exp.py url "cmd" exemple: python3 exp.py http://192.168.1.1/ whoami...

eval-stdin

Уязвимость Util PHP eval-stdin.php CVE-2017-9841 — это RCE-уязвимость в устаревшем eval-stdin.php. Этот эксплойт — просто автоматизация упомянутой уязвимости и всё ещё находится в разработке. Скрипт написан на Ruby 3.0.4 за 2 часа, протестирован на Kali linux, Arch Linux, Ubuntu minimal и Termux...

CVE-2025-29017

CVE-2025-29017 - 인터넷 뱅킹 시스템 2.0.0 프로필 사진 업로드를 통한 원격 코드 실행 설명 Code Astro Internet Banking System 2.0.0 에서 pagesviewclient.php의 profilepic 매개변수에 대한 파일 업로드 검증 부재 로 인해 원격 코드 실행RCE 취약점이 존재합니다. 공격자는 업로드 요청을 수정하여 보안 검사를 우회하고 임의 코드 실행 을 유발할 수 있습니다. 영향을 받는 구성 요소 pagesviewclient.php의 profilepic 매개변수 업로드 기능...

redis-stack-CVE-2024-55656

CVE-2024-55656 - Redis Stack - Vulnérabilité d'exécution de code à distance par dépassement d'entier dans RedisBloom Titre : Vulnérabilité d'exécution de code à distance par dépassement d'entier dans Redis Stack RedisBloom ZDI : ZDI-25-009 CVE : CVE-2024-55656 Crédits : rick2600 et gqsilva CVSS :...

MS15-034

MS15-034 MS15-034 POC La version actuelle du serveur IIS est une version vulnérable qui possède des vulnérabilités connues CVE-2015-1635, MS15-034, et l'exploitation de ces vulnérabilités expose à un risque d'attaque telle que l'exécution de code à distance ou l'écran bleu Blue Screen. Syntaxe de...

CVE-2016-6366

CVE-2016-6366 Dépôt public pour les améliorations de l'exploit EXTRABACON, une exécution de code à distance pour Cisco ASA écrite par l'Equation Group NSA et divulguée par les Shadow Brokers. Il contient un shellcode amélioré, un script de recherche d'offset LINA, un module Metasploit et...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus vulnérable à l'exécution de code à distance RCE en raison d'une désinfection incorrecte des entrées Aperçu CVE-2024-21534 est une vulnérabilité critique présente dans les versions du package jsonpath-plus antérieures à la version 10.0.0. La vulnérabilité provien...

CVE-2025-37164-PoC

CVE-2025-37164 - PoC RCE non authentifiée HPE OneView Exploit Proof-of-Concept pour CVE-2025-37164, une vulnérabilité critique CVSS 10.0 d'exécution de code à distance non authentifiée dans HPE OneView. AVERTISSEMENT CE LOGICIEL EST FOURNI UNIQUEMENT À DES FINS ÉDUCATIVES ET DE TESTS DE SÉCURITÉ...