CVE-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...

CVE-2021-46364

CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia versions =6.2.3 has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files. Remote Code Execution has been achieved using this...

CVE-2022-40634

CVE-2022-40634: FreeMarker Server-Side Template Injection in CrafterCMS By inserting malicious content in a FTL template, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote Code Execution...

CVE-2026-64638

CVE-2026-64638 // XSS2Shell Technical analysis and defensive mitigation matrix for the CVE-2026-64638 XSS2Shell vector, a critical parsing inconsistency in the WordPress Core authentication screen that makes it possible to chain a reflected pre-authentication Cross-Site Scripting XSS with browser...

CVE-2017-7269-Echo-PoC

CVE-2017-7269 Remote Code Execution Echo Verification Our team's analysis report on the CVE-2017-7269 vulnerability: https://ht-sec.org/cve-2017-7269-vulnerabilities/ The default PoC only launches calc.exe. Now it has been modified to respond to requests. The command format is:...

CVE-2019-2890

Disclaimer For learning and communication purposes only. Use for other purposes is at your own risk. Description The relevant jar files have been imported into the project, and the exploitation method uses yso's JRMP. When learning and debugging, you can modify the exploitation method. First, pla...

EUVD-2026-65440

NLTK: Allowlisted pickle loaders still permit code execution in current source...

CVE-2026-29041

CVE-2026-29041 — Authenticated RCE via Unrestricted File Upload in Chamilo LMS 1.11.32 -yellow?style=for-the-badge Authenticated Remote Code Execution in Chamilo LMS 1.11.32 via improper file upload validation in the ckuploadimage AJAX endpoint. A low-privileged student can upload a PHP web shell...

EUVD-2026-65229

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution...

cacti-rce-cve-2022-46169-vulnerable-application

Cacti v1.2.22 command injection CVE-2022-46169 vulnerable application This is a vulnerable application to test the exploit for the Cacti vulnerability CVE-2022-46169. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up...

CVE-2026-41179

CVE-2026-41179 — rclone RC API Unauthenticated RCE ⚠️ EDUCATIONAL PURPOSES ONLY This repository is intended strictly for security research, education, and authorized lab environments. PSSec and the contributors of this repository do not condone, support, or take any responsibility for any...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description : User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description The User Registration Advanced Fields plugin for WordPress versions up to and including...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084, vulnerabilidad de inyección OGNL en Atlassian Confluence Atlassian Confluence es un sistema wiki ampliamente utilizado en empresas. En algunas de sus versiones existe una vulnerabilidad de inyección de expresiones OGNL. Un atacante puede explotar esta vulnerabilidad...

CVE-2026-86732

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

cve-2021-44228-log4j-exploits

CVE-2021-4428 Reproduction This DEMO is a replication of the Log4j2 ultra-high-risk RCE vulnerability CVE-2021-4428, aiming to understand the harmfulness of this vulnerability and make targeted defenses based on your system's situation. Warning This DEMO is solely for technical research purposes...

CVE-2022-26134-Exploit-Detection

Detección de Exploit de Confluence RCE CVE-2022-26134 Requisitos previos 1. ClamAV Clona este repositorio o descarga la regla Yara en tu servidor Confluence Estamos usando la regla Yara proporcionada por volexity/threat-intel, quienes revelaron esta vulnerabilidad por primera vez. Git Clone...

cacti-rce-snmp-options-vulnerable-application

Cacti v1.2.24 authenticated command injection CVE-2023-39362 vulnerable application This is a vulnerable application to test the exploit for the Cacti vulnerability CVE-2023-39362. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended usin...

cacti-rce-snmp-options-vulnerable-application

Уязвимое приложение Cacti v1.2.24 с аутентифицированным внедрением команд CVE-2023-39362 Это уязвимое приложение для проверки эксплойта для уязвимости Cacti CVE-2023-39362. ПРЕДУПРЕЖДЕНИЕ! Это приложение содержит серьезные уязвимости безопасности. Запускайте его на свой страх и риск! Рекомендуетс...

Joplin-CVE-2022-35131

Joplin CVE-2022-35131 XSS leading to RCE in Joplin affecting version 2.8.8 and earlier. Tested and works on Windows and Linux. Reported and fixed: 2022-06 Technical overview 1. Create a note with javascript payload as title POC:s bellow 2. Press Ctrl+P and search for something in the note or titl...

CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Remote code execution of user-provided local names in Rails Remote code execution of user-provided local names in Rails 5.0.1 There was a vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render cal...