wp2shell-Exploit-Waf-Bypass

root@kitploit: | \ / / / / / | | /| / / \ / // / / / / / | |/ |/ / // // / / / / / / / |/|/////// ///// WordPress Pre-Auth RCE — CVE-2026-63030 + CVE-2026-60137 di Venexy M4xSec Esecuzione remota di codice senza autenticazione su WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1. Corretto in...

CVE-2026-82422

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/empdel.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may...

CVE-2026-82423 macrozheng mall Payment Status Endpoint paySuccess behavioral workflow

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be...

CVE-2026-82423

A behavioral workflow enforcement vulnerability exists in the macrozheng mall project (up to version 1.0.3 ). The issue affects the Payment Status Endpoint at the file /order/paySuccess, where manipulation of the orderId argument allows a remote, low-privilege attacker to enforce a behavioral wor...

CVE-2026-82423 macrozheng mall Payment Status Endpoint paySuccess behavioral workflow

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be...

Struts2Vuln

Applicazione Struts2 vulnerabile Requisiti 1. Maven https://maven.apache.org 2. Struts = 2.5.10 CVE-2017-5638 - Apache Struts 2 RCE tramite form multipart Requisiti 1. Individuare un URL che invia una richiesta POST multipart form Per iniziare 1. L'applicazione / server può essere avviato con il...

CVE-2026-82422 itsourcecode Sales and Inventory System emp_del.php sql injection

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/empdel.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may...

CVE-2026-82422

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 , specifically in the file /pages/emp_del.php. Manipulation of the ID argument allows a remote attacker with low privileges to execute arbitrary SQL, impacting confidentiality, integrity, and availability (CVSS 3....

CVE-2026-9198

CVE-2026-9198 - IBM Langflow OSS Esecuzione Remota di Codice Non Autenticata RCE Vulnerabilità critica di esecuzione remota di codice non autenticata che interessa IBM Langflow OSS. La vulnerabilità deriva dalla combinazione di due debolezze: 1. /api/v1/autologin può rilasciare un bearer token...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Unrestricted File Upload → RCE Critica vulnerabilità di Unrestricted File Upload in Elementor Pro Potenzialmente in grado di portare a Remote Code Execution RCE ⚠️ Panoramica CVE-2026-32475 è una vulnerabilità critica che interessa Elementor Pro , un plugin...

CVE-2021-40373

CVE-playsms C'è una vulnerabilità in playsms 1.4.3 che consente a potenziali aggressori di eseguire codice in remoto. come riprodurre l'RCE shell: https://playsms.org/ docker pull playsms/playsms:1.4.3 docker run -d -p 80:80 playsms/playsms effettuare il login con admin:admin...

CVE-2026-60004-poc-gitea

CVE-2026-60004 Proof-of-Concept PoC Panoramica Questo repository contiene uno strumento proof-of-concept per CVE-2026-60004, un vettore di esecuzione remota di codice RCE autenticato o pre-autenticazione che interessa alcune versioni di Gitea tramite la tecnica di iniezione di hook diffpatch...

CVE-2026-82421

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/empedit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might b...

CVE-2026-82421

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 , specifically in the file /pages/emp_edit.php . The unvalidated ID argument can be manipulated to inject SQL queries. The attack is remotely exploitable with low privileges required and no user interaction. The e...

CVE-2026-82421 itsourcecode Sales and Inventory System emp_edit.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/empedit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might b...

EUVD-2026-68136

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/empedit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might b...

MAL-2026-15597 Malicious code in npx-oob-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6302c47700c024cb727f6139b5cd8703da7c295555525ce9624c12b536f76dde npx-oob-package ships bin/cli.js which is also declared as the package main. On both CLI invocation and any require/import of the package, the module...

CVE-2024-6333

CVE-2024-6333 - Esecuzione di codice remoto autenticata su Xerox Vulnerabilità di esecuzione di codice remoto autenticata nelle stampanti Xerox WorkCentre tramite la funzionalità Network Troubleshooting Log. Descrizione La funzionalità Network Troubleshooting Log...

CVE-2017-7494

Exploit di SambaCry CVE-2017-7494 CVE-2017-7494/SambaCry consente agli utenti autenticati di caricare una libreria condivisa in una cartella scrivibile e di eseguire un attacco di esecuzione utilizzando le librerie caricate. Spiegazione della vulnerabilità SambaCry è una vulnerabilità di...

cve-2022-1471-jira-lab

CVE-2022-1471 — Lab RCE SnakeYAML contesto Jira / Automation for Jira Lab offline e autonomo che dimostra il meccanismo alla base di CVE-2022-1471 deserializzazione non sicura SnakeYAML → RCE, CVSS 9.8, come sfruttato nel finding su Jira / Jira Service Management contro un host con 9.4.9 range...