CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: TP-Link Router OS Command Injection For more Information see https://vulners.com/cve/CVE-2026-3227 A persistent, authenticated OS Command Injection vulnerability in TP-Link router firmware leading to device bricking or potential LAN takeover. Disclaimer : This repository contains...

CVE-2023-5808

CVE-2023-5808 CVE-2023-5808 is an Insecure Direct Object Reference IDOR in vulnerability found in Hitachi NAS' HNAS' System Management Unit SMU Backup & Restore functionality. This vulnerability affects SMU versions prior to 14.8.7825.01. Exploitation This exploit requires the attacker to have...

CVE-2024-31771

CVE-2024-31771 TotalAV Arbitrary File Write TotalAV version 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 Timeline: 13th Feb, 2024 : Discovered 6.0.740 vulnerable and reported to TotalAV. 15th Feb, 2024: TotalAV confirmed and reproduced the...

pgadmin4-9.10-CVE-2025-13780

pgadmin4 9.11 Meta-Command Filter Command Execution Summary The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for Issue 9320 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark EF BB BF or other special sequences. The implemented filter...

CVE-2025-13780

CVE-2025-13780: pgAdmin 4 = 8.14 RCE Scanner A comprehensive vulnerability scanner for CVE-2025-13780 , a Remote Code Execution RCE vulnerability in pgAdmin 4 versions ≤ 8.14. 🔍 Vulnerability Details The vulnerability exists in the Restore feature of pgAdmin 4. The application attempts to block...

CVE-2026-25243

CVE-2026-25243 — Redis RESTORE zipmap double-free → remote code execution TL;DR. A malformed DUMP payload passed to RESTORE triggers a heap double-free in Redis's legacy hash-zipmap loader. Under default jemalloc the double-free is silent the server keeps running, which turns it into a controllab...

SparstanBoogie

SparstanBoogie's origins were tested reportedly on iOS/iPadOS 15.2 - 16.7 RC 20H18 and 17.0 however, tests have been conducted up to 26.1 26.1. Also any testing on devices above or under whats been reported is welcomed as it may come back in newer devices so theres no reason to shrug off any good...

CVE-2023-22518

CVE-2023-22518 Exploit for Confluence CVE-2023-22518 backup-restore RCE Endpoint POST /setup/setup-restore.action Requires valid login and admin rights or an auth bypass Files xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!! Replace with any backup...

CVE-2026-41177-Squidex-CMS

CVE-2026-41177: Squidex CMS Blind SSRF Technical research and analysis for CVE-2026-41177: A Blind Server-Side Request Forgery SSRF vulnerability in the Squidex CMS Restore API. Vulnerability Overview CVE ID: CVE-2026-41177 Affected Component: Squidex API: Backup / Restore Engine /api/apps/restor...

CVE-2025-43537

CVE-2025-43537 Apple Security Credit Researcher: Al Sadman Awal Officially credited by Apple Product Security for the responsible disclosure of CVE-2025-43537. Overview CVE-2025-43537 is a security vulnerability identified during independent security research and responsibly disclosed to Apple...

CVE-2024-44258

CVE-2024-44258: Symlink Vulnerability in ManagedConfiguration Framework Summary CVE-2024-44258 highlights a symlink vulnerability within the ManagedConfiguration framework and the profiled daemon in Apple devices. When restoring a crafted backup, the migration process fails to validate whether th...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 References respect to the masters: CVE-2023-50386 vulnerability author's blog Java Security Manager Bypass Techniques Bypassing Reflection Protection in JDK 17 JNI Bypassing RASP Vulnerability exploitation...

halo-2.25.4-backup-write-CVE-2026-67920

Halo CMS Backup Restore Arbitrary File Write Vulnerability Summary A critical arbitrary file write vulnerability exists in the backup restoration functionality of Halo CMS versions up to 2.25.4. The restoreWorkdir method in MigrationServiceImpl.java copies the workdir/ directory from a...

CVE-2023-22518

CVE-2023-22518 Exploit Description This repository contains an exploit script for CVE-2023-22518. The script allows for unauthorized file uploads, potentially leading to remote code execution or other security vulnerabilities. Disclaimer This repository is for educational and informational purpos...

CVE-2025-8714-POC

CVE-2025-8714-POC PoC de RCE en PostgreSQL — CVE-2025-8714 PoC de Ejecución Remota de Código en PostgreSQL — CVE-2025-8714 pgdump Reverse Shell Este repositorio presenta una prueba de concepto PoC para la vulnerabilidad crítica CVE-2025-8714 que afecta a versiones PostgreSQL anteriores a: 17.6,...

CVE-2026-1357

CVE-2026-1357 Lab Environment for CVE-2026-1357 1. Build the environment sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip...

colabcat

Colabcat Run Hashcat on Google Colab with session restore capabilities with Google Drive. Usage Go to the link below to open a copy of the colabcat.ipynb file in Google Colab: https://colab.research.google.com/github/someshkar/colabcat/blob/master/colabcat.ipynb Click on Runtime, Change runtime...

MSSQL-Analysis-Coerce

MSSQL Analysis Services - Coerced Authentication A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine. This proof of concept is co-authored by : Podalirius: Worty: Proof of concept In order to trigger the authentification as the local machine account, we need to...

gitea-restore-file-open

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-restore-file-open gitea-restore-file-open Gitea 1.27.3 - Gitea CVE-2026-59765 put a hostmatcher HTTP client on OpenWithClient. The file:// branch ignores that client and calls os.Open. Restore of a dump has no...

SUSE CVE-2026-98905

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfdqueueacquirebuffers was split off from setqueuepropertiesfromuser, setqueuepropertiesfromcriu was missed. Thus, setqueuepropertiesfromcriu is not filling out the...