cornershot

What is CornerShot In warfare, CornerShot is a weapon that allows a soldier to look past a corner and possibly take a shot, without risking exposure. Similarly, the CornerShot package allows one to look at a remote host’s network access without the need to have any special privileges on that host...

CVE-2024-27198-POC

CVE-2024-27198 – JetBrains TeamCity प्रमाणीकरण बाईपास और RCE PoC लेखक: EynaExp क्षेत्र: शोध / रक्षात्मक सत्यापन / केवल अधिकृत परीक्षण अवलोकन इस रिपॉजिटरी में JetBrains TeamCity इंस्टेंस को लक्षित करने वाला एक प्रूफ-ऑफ-कॉन्सेप्ट मास स्कैनर शामिल है, जो CVE-2024-27198 से प्रभावित हैं — यह एक...

CVE-2025-55182-Scanner

CVE-2025-55182 RCE Scanner Scanner di rilevamento e verifica in modalità batch per la vulnerabilità di esecuzione remota di codice CVE-2025-55182 React2Shell. ⚠️ Vulnerabilità critica con CVSS 10.0 | Colpisce React Server Components e le versioni Next.js 15.x/16.x | Solo per test di sicurezza...

apache_audit_cve-2026-23918

cve-2026-23918 Strumenti di audit difensivo per CVE-2026-23918 Apache HTTPD HTTP/2 double-free RCE e quattro CVE correlate divulgate nell'avviso di sicurezza del 4 maggio 2026 della Apache Software Foundation...

CVE-2022-44276-PoC

CVE-2022-44276-PoC PoC für Responsive Filemanager 9.12.0: Umgehung der Upload-Beschränkungen führt zu RCE Wo steckt die Schwachstelle? Beim Hochladen einer neuen Datei durchlaufen wir die Funktion fixfilename:...

CVE-2024-36401_Geoserver_RCE_POC

⚠️ Avvertenza: Questo strumento è destinato esclusivamente alla ricerca sulla sicurezza e a test autorizzati legalmente. Non utilizzarlo per scopi illeciti. L'utente si assume ogni responsabilità legale. README Versione: English | Italiano Descrizione della vulnerabilità Questo script è uno...

CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

EUVD-2026-65229

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

CVE-2026-78683

NLTK versions ≤3.9.4 contain an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with restricted=False, routing through WarningUnpickler , which does not override find_class() and thus permits arbit...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676

GitPython versions before 3.1.59 are vulnerable to remote code execution via git-config injection. The root cause is unsafe re-serialization of multi-line git-config values during write operations: embedded newlines in quoted values are corrupted into live directives such as core.hooksPath . An a...

CVE-2026-75574

CVE-2026-75574 is a remote code execution vulnerability in the Grav Email plugin (getgrav/grav-plugin-email) versions before 4.2.2 . The root cause is that page-editor-controlled Email action parameters are rendered as unsandboxed Twig templates . An authenticated remote user possessing only api....

EUVD-2026-65203

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

CVE-2026-56705 Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

CVE-2026-56705

Adminer versions prior to 5.4.3 are vulnerable to unauthenticated remote code execution via ODBC parameter injection. The root cause is a failure to sanitize the server field before constructing a PDO DSN string , enabling attackers to inject parameters using semicolons. Specifically, injecting T...

CVE-2026-56705

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

CVE-2026-56703 Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

CVE-2026-56703

Adminer before 5.4.3 is affected by a remote code execution vulnerability in its SQLite query handling . The root cause is that the VACUUM INTO statement is not blocked despite ATTACH restrictions being in place, allowing an authenticated attacker to write arbitrary PHP code to chosen file paths ...

EUVD-2026-65201

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

CVE-2026-56703

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...