CVE-2025-3248

CVE-2025-3248 – Execute arbitrary Python code on vulnerable Langflow server. Discovered by: Naveen Sunkavally, Horizon3.ai Status: Public Disclosure Date Reported: 2025-04-07 CVE ID: CVE-2025-3248 🧾 Screenshot 🧩 Summary A critical flaw has been discovered in Langflow that allows malicious actors ...

CVE-2024-50379

CVE-2024-50379 CVE-2024-50379 ist eine schwerwiegende Sicherheitslücke, die Apache Tomcat betrifft und es einem Angreifer ermöglicht, falsche Konfigurationen oder Schwachstellen auszunutzen, um Code aus der Ferne auszuführen RCE. Bei Ausnutzung kann diese Schwachstelle zur Übernahme des Servers,...

domi-owned

Domi-Owned Resumo Domi-Owned é uma ferramenta usada para comprometer servidores IBM/Lotus Domino. Testado em IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0 e 9.0.1 rodando em Windows e Linux. Requisitos Domi-Owned usa Python 3, que pode ser instalado através do gerenciador de pacotes da sua distribuição ap...

yasuo

YASUO @0xsauby Description Yasuo is a ruby script that scans for vulnerable 3rd-party web applications. While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise th...

Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...

Traggo Server - Local File Inclusion

traggo/server version 0.3.0 is vulnerable to directory traversal. id: CVE-2023-34843 info: name: Traggo Server - Local File Inclusion author: DhiyaneshDk severity: high description: | traggo/server version 0.3.0 is vulnerable to directory traversal. impact: | Successful exploitation of this...

FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval, letting unauthenticated attackers execute arbitrary PHP code on the server. id: CVE-2026-6433 info: name: FlipperCode Custom CSS, JS & PHP = 2.0.7 -...

DedeCMS 5.7.109 - Server-Side Request Forgery

Manipulation of the rssurl parameter in codo.php leads to server-side request forgery in DedeCMS version 5.7.109. id: CVE-2023-3578 info: name: DedeCMS 5.7.109 - Server-Side Request Forgery author: ritikchaddha severity: critical description: | Manipulation of the rssurl parameter in codo.php lea...

ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzzfile.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter, exploit requires attacker to send malicious URL and...

TurboMeeting - Boolean-based SQL Injection

A Boolean-based SQL injection vulnerability in the "RHUB TurboMeeting" web application. This vulnerability could allow an attacker to execute arbitrary SQL commands on the database server, potentially allowing them to access sensitive data or compromise the server. id: CVE-2024-38289 info: name:...

CVE-2021-22205

CVE-2021-22205 Poiché Gitlab non convalida correttamente i file immagine passati al parser di file, viene eseguito un comando arbitrario. Un attaccante può costruire una richiesta malevola per sfruttare questa vulnerabilità ed eseguire comandi arbitrari sul sistema di destinazione, portando al...

CVE-2026-27944

CVE-2026-27944 - Téléchargement et déchiffrement non authentifiés de sauvegarde Nginx UI https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red Une preuve de concept PoC pour CVE‑2026‑27944, une vulnérabilité...

CVE-2026-48908

🚨 CVE-2026-48908 — Compromission totale du serveur via téléchargement arbitraire de fichiers Téléchargement critique de fichier non authentifié → Exécution de code à distance RCE Une vulnérabilité critique dans SP Page Builder permet à des attaquants non authentifiés de télécharger des fichiers...

CVE-2023-1454-EXP

CVE-2023-1454-EXP CVE-2023-1454 jeecg-boot Vulnerabilità di SQL injection non autorizzata JeecgBoot è una piattaforma di sviluppo low-code basata su un generatore di codice. Utilizzata per applicazioni Web aziendali, la piattaforma Java low-code jeecg-bootv3.5.0 presenta la più recente SQL...

PT-2026-82328

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

cve-2024-0305exp

cve-2024-0305exp Verfügbarer Exploit für cve-2024-0305. Bei Verwendung bitte die Quelle angeben. Danke! 0x01 Produkthintergrund Das Ncast Yingkeshi HD-Intelligent-Aufzeichnungs- und Übertragungssystem ist ein Produkt der Guangzhou Yingkeshi Electronic Technology Co., Ltd. Dieses System weist eine...

CrafterCMS-CVE-2025-6384

CrafterCMS प्रमाणित RCE - Groovy सैंडबॉक्स बाईपास CVE-2025-6384 CrafterCMS में प्रमाणित रिमोट कोड एक्ज़ीक्यूशन भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट। भेद्यता सारांश डेवलपर विशेषाधिकारों वाला एक प्रमाणित उपयोगकर्ता रिमोट कोड एक्ज़ीक्यूशन RCE प्राप्त करने के लिए Crafter Studio में Groovy स्क्रिप्ट...

LimeSurvey 4.1.11 - Local File Inclusion

LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. id: CVE-2020-11455 info: name: LimeSurvey 4.1.11 - Local File Inclusion author: daffainfo severity: critical...

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China,...

CVE-2025-14601

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...