CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2026-65463

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949

The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....

CVE-2023-33538-msf

CVE-2023-33538 – Iniezione di comandi in TP-Link TL-WR940N/841N modulo Metasploit Questo modulo ausiliario di Metasploit mira a una vulnerabilità di iniezione di comandi autenticata nei router TP-Link TL-WR940N V2/V4 e TL-WR841N V8/V10. Il problema risiede nel parametro vulnerabile ssid1 usato in...

SNMPocalypse-Cisco-Bug-Lets-Hackers-Crash-or-Command-Devices

SNMPocalypse-Cisco-Fehler-lässt-Hacker-Geräte-zum-Absturz-bringen-oder-steuern CVE-2023-20352 ist ein kritischer Stack-Überlauf-Fehler in der SNMP-Engine von Cisco IOS/IOS XE. Mit nur präparierten SNMP-Paketen können entfernte Angreifer Systeme zum Absturz bringen oder die Root-Kontrolle...

From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack

De EternalBlue ao CVE‑2025‑2776: A Evolução de um Ataque SMB Ele abalou o mundo em 2017 e evoluiu para o atual CVE‑2025‑2776. A Microsoft ainda depende do SMBv1; este artigo explicará como os atacantes ajustaram a cadeia, de uma simples DLL a uma pilha completa de reverse shell, e o que isso...

DNS-Mayhem-CVE-2026-41096-Deep-Dive

DNS-Mayhem-CVE-2026-41096-Analyse-Approfondie Analyse technique approfondie de CVE‑2026‑41096, un débordement de tas critique dans DNSAPI.dll de Windows permettant l'exécution de code à distance via des réponses DNS malveillantes. Inclut des vecteurs d'attaque, des informations sur le correctif e...

CVE-2025-27480-The-Silent-Gateway-Risk

CVE-2025-27480-Das-stille-Gateway-Risiko Ermöglicht Angreifern, schädlichen Code auszuführen, ohne dass ein geknacktes Passwort, eine Benutzerinteraktion oder sogar ein Fuß im Netzwerk erforderlich ist. Das ist CVE-2025-27480 Es ist spät, du läufst auf Red Bull – wir kennen das alle. Du behebst e...

CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates

CVE-2025-26686-La-Peculiarita-del-Protocollo-TCP-IP-Che-Apre-i-Cancelli Una vulnerabilità critica di RCE nello stack TCP/IP di Windows CVE-2025-26686 lascia memoria sensibile sbloccata, consentendo a un attaccante remoto di dirottare i sistemi. Sfruttabile attraverso la rete, rischia la...

CVE-2021-41773

RCE-Exploit für Apache 2.4.49 CVE-2021-41773 und 2.4.50 CVE-2021-42013: IMHO nur „spezielle“ Setups sind für diesen RCE anfällig. Dasselbe gilt für die „Arbitrary File Read“-Exploits, die du gesehen hast. Beide CVEs sind tatsächlich fast dieselbe Path-Traversal-Schwachstelle die zweite ist der...

CVE-2026-12277

CVE-2026-12277 Plugin Frontend File Manager WordPress = 23.6 – Eliminazione arbitraria di file non autenticata a RCE Riepilogo...

CVE-2021-44967

CVE-2021-44967 - RCE Autenticado privilegiado Execução remota de comandos autenticada privilegiada no LimeSurvey Versão 5.2.4 através do upload e instalação de plugins permite que um usuário remoto faça upload de arquivo de código PHP arbitrário. Uso python3 exploit.py --url --user --password...

CVE-2026-78863

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...

CVE-2025-2945

CVE-2025-2945 - Exploit RCE autenticato in pgAdmin4 Autore: G0D150NE Versione: 2.0.0 CVE: CVE-2025-2945 Gravità: Critica CVSS 9.9 📌 Descrizione Exploit per la vulnerabilità di Remote Code Execution RCE in pgAdmin4 che interessa le versioni dalla 8.10 alla 9.1. La vulnerabilità è presente...

cve-2010-2075-analysis

CVE-2010-2075 – Backdoor UnrealIRCd Esecuzione Remota di Codice Panoramica Questo repository documenta l'analisi e lo sfruttamento di CVE-2010-2075, una vulnerabilità backdoor che interessa UnrealIRCd 3.2.8.1. La vulnerabilità è stata riprodotta in un ambiente di laboratorio controllato utilizzan...

CVE-2025-55182-React2Shell-Lab

CyberSec Blog CTF - React2Shell PoC Questo repository fornisce un ambiente CTF Capture The Flag vulnerabile basato su un blog di cybersecurity che utilizza Next.js e React Server Components. CVE-2025-55182 : Vulnerabilità di esecuzione di codice in remoto RCE pre-autenticazione in React Server...

CVE-2021-42171

CVE-2021-42171 Datei-Upload zu Remote Code Execution auf Zenario CMS 9.0.54156 https://minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74 root@kitploit: Server test Distributor ID: Ubuntu Description: Ubuntu 21.04 Release: 21.04 Codename: hirsute...

ProxyLogon-CVE-2021-26855

ProxyLogon-CVE-2021-26855 Exploit RCE para a vulnerabilidade ProxyLogon no Microsoft Exchange Funciona com Python 3.9 Uso: python proxylogonrce.py target email command Exemplo: python proxylogonrce.py 192.168.227.137 [email protected] whoami Todos os créditos vão para a DEVCORE, baseado em...

Struts2Vuln

Applicazione Struts2 vulnerabile Requisiti 1. Maven https://maven.apache.org 2. Struts = 2.5.10 CVE-2017-5638 - Apache Struts 2 RCE tramite form multipart Requisiti 1. Individuare un URL che invia una richiesta POST multipart form Per iniziare 1. L'applicazione / server può essere avviato con il...

CVE-2026-16723

A flaw was found in fastjson. This remote code execution RCE vulnerability allows a remote attacker to execute arbitrary code on the system. The vulnerability is exploitable under fastjson's default configuration, meaning no special setup or AutoType enablement is required for exploitation...