CVE-2021-32158

..| XSStoCommandInjection1 |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Command Injection through the Webmin's Upload and Download feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's...

CVE-2026-109619

CVE-2026-109618 / CVE-2026-109619 PHP2Shell RCE ★ CVE-2026-109618 / CVE-2026-109619 PHP session.uploadprogress Pre-Auth RCE PoC ★ Overview PHP2Shell CVE-2026-109618 / CVE-2026-109619 is an unauthenticated Remote Code Execution flaw in PHP under Apache modphp. A crafted multipart/form-data request...

EUVD-2026-114521

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.1, the refitter dotnet tool invokes NJsonSchema with unsafe defaults for $ref resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions...

CVE-2022-26134

CVE-2022-26134 - Confluence OGNL injection vulnerability Script Usage Install Python libraries pip install -r requirements.txt Vulnerability Verification python3 CVE-2022-26134check.py -u url -c whoami Batch Scanning python3 CVE-2022-26134check.py -f url.txt -c whoami Affected Versions Confluence...

CVE-2026-32475

CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary File Upload to RCE Elementor Pro Pre-Authentication Arbitrary File Upload Leading to Remote Code Execution Proof-of-concept for CVE-2026-32475, a critical unauthenticated arbitrary file upload in Elementor Pro's Forms module that ends i...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Remote Code Execution CVSS 9.8 Critical | Unsafe File Operations → Log Poisoning → Phar Deserialization → RCE Overview Laravel Ignition -c "whoami" References NVD — CVE-2021-3129 Ignition Patch 2.5.2...

From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack

From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack It shook the world in 2017 and has evolved into today’s CVE‑2025‑2776. Microsoft still relies on SMBv1, this article will explain how attackers have tweaked the chain from a simple DLL to a full reverse‑shell stack, and what that...

cve-2026-41042

CVE-2026-41042: Apache Gravitino 1.2.1 Unauthenticated RCE Self-contained, stdlib-only proof of concept for CVE-2026-41042: unauthenticated remote code execution in Apache Gravitino before 1.2.1 via the H2 JDBC INIT connection setting. No auth headers, no extra drivers, no pip installs. python3...

CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

-CVE-2014-6271

/ || | | | | | | | / || | | |/ \ / | |/ / \ | || | | | | | | \ | || | | | | | | ' / | | || || | | | || | || . \ |/|| |||||/|| ||/ ||\ CVE-2014-6271 — Shellshock Remote Code Execution via Bash Environment Variable Injection "A flaw hidden in Bash for decades that shook the foundations of the...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontroll...

CVE-2025-67511

CVE-2025-67511: Tricking a Security AI Agent Into Pwning Itself Hacktive Security blog post for CVE-2025-67511 Blog Post Link : https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself/ TL;DR A command injection vulnerability in the function...

ToolShellFinder

🛠️ ToolShellFinder: CVE-2025-53770 & CVE-2025-53771 Detection A high-performance PowerShell 7+ script for scanning IIS logs to detect signs of exploitation related to ToolShell , specifically targeting the zero-day vulnerabilities CVE-2025-53770 and CVE-2025-53771 in Microsoft SharePoint. This...

L4J-Vuln-Patch

NOTICE This tool is no longer necessary mojang has released its own patch which should cover everyone who is affected https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition WARNING THIS EXPLOIT EFFECTS BOTH CLIENTS AND SERVERS There is currently a exploit...

CVE-2026-63115 ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

CVE-2026-63115 ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

CVE-2026-63115

The ActivityPub server (versions 1.0.0 through 1.2.6), a multi-tenant ActivityPub server for Ghost built with Fedify, contains a vulnerability in the Undo handler . This flaw allows a remote federated server to trigger actions as if they originated from a different account, enabling the unfollow ...

EUVD-2026-114518

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

CVE-2026-63115 ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

CVE-2025-55182-Waf

Next.js/React RSC Scanner & Exploit - RCE This tool is designed for security researchers and penetration testers to detect and exploit the CVE-2025-55182 vulnerability in Next.js/React RSC applications. It provides multiple scanning modes, exploitation features, and WAF bypass techniques. ✨...