EUVD-2026-67228

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is...

CVE-2026-81833 RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is...

CVE-2022-26134

CVE-2022-26134 Iniezione Object-Graph Navigation Language OGNL pre-autenticazione in Confluence Confluence è un prodotto di collaborazione workspace basato sul web sviluppato da Atlassian. Può essere distribuito on-prem o come parte di Atlassian Cloud. È composto da 3 funzionalità chiave: pagina,...

CVE-2021-21983

CVE-2021-21975 Beliebiger Datei-Schreibzugriff in der VMware vRealize Operations vROps Manager API führt zu Remote Code Execution RCE vRealize Operations vROps ist ein Tool für selbstfahrendes, KI-gestütztes IT-Operations-Management – von Anwendungen bis zur Infrastruktur – das VMware-Cloud- und...

CVE-2025-55182-Exploit-PoC-Scanner

CVE-2025-55182 – Exploit de RCE em React Server Components v2.0 Uma ferramenta abrangente de pesquisa em segurança para testar as vulnerabilidades CVE-2025-55182 e CVE-2025-66478 em React Server Components RSC e Server Actions do Next.js. Visão Geral da Vulnerabilidade...

CVE-2026-81934

Redis contains a use-after-free vulnerability in the tlsProcessPendingData() function, which manages the TLS pending-data list. Only deployments configured with TLS support are affected; non-TLS instances are not impacted. A remote, unauthenticated attacker can trigger memory corruption over TLS ...

EUVD-2026-67227

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. Fixed in...

CVE-2026-81934 Redis TLS pending-data list use-after-free

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server...

CVE-2025-67887

CVE-2025-67887 1C-Bitrix = 25.100.500 Modulo di Traduzione Vulnerabilità di Esecuzione Remota di Codice...

DLHell

DLHell DLHell führt lokales und entferntes Windows-DLL-Proxying über DCOM aus. Install Die folgenden Pakete werden benötigt kann von deiner Distribution abhängen, das folgende Beispiel ist für Debian 12: root@kitploit: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64...

CVE-2022-39802

3242933 – CVE-2022-39802 Vulnerabilità di path traversal nei file in SAP Manufacturing Execution Informazioni generali Rischio: CRITICO Versioni Affette: root@kitploit: SAP MFG EXECUTION CORE 15.1 SAP MFG EXECUTION CORE 15.2 SAP MFG EXECUTION CORE 15.3 URL del fornitore: https://sap.com Bug:...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0 , the default-on Safe import filter sanitizes HTML only for text notes but excludes the book note type. Book note content is stored unsanitized and later injected into the page via jQuery's htm...

EUVD-2026-67224

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

Apache-Solr-RCE-via-Velocity-template

Apache-Solr-RCE-via-Velocity-template Referenzlink Ursache der Schwachstelle: 1. Wenn ein Angreifer direkt auf die Solr-Konsole zugreifen kann, kann er über eine POST-Anfrage ähnlich wie /Knotenname/config die Konfigurationsdatei dieses Knotens ändern. 2. Apache Solr integriert standardmäßig das...

PHP-8.1.0-dev_WebShell-RCE

PHP 8.1.0-dev WebShell RCE Non autenticato Codice Exploit per PHP 8.1.0-dev WebShell RCE Non autenticato Risultato atteso: sfruttare la backdoor installata sul server PHP 8.1.0-dev ottenendo così una WebShell per eseguire comandi da remoto. Destinato solo a scopo educativo e a test in ambienti...

RP_Import_RCE

Real Player 'external::Import' Beliebiges Herunterladen von Dateien, Directory-Traversal-Schwachstellen führen zu Remote Code Execution Video-Demo: https://youtu.be/CONlijEgDLc Real Player nutzt Funktionen von Microsoft Internet Explorer und legt Eigenschaften und Methoden über ein spezielles,...

RP_DCP_Code_Exec

Vulnerabilità di esecuzione arbitraria di codice da remoto tramite l'URI 'DCP://' di Real Player Video demo: https://youtu.be/AMODp3iTnqY Lo schema URI 'DCP://' è un protocollo interno usato da Real Player per recuperare URL da visualizzare nella scheda del browser del Player. Sta per 'Data Cache...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Vulnerabilità di esecuzione remota di codice Video dimostrativo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Il componente G2 Control di Real Player contiene una vulnerabilità di esecuzione remota di codice perché consente di passare URI 'javascript...