MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass

MLflow 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint. id: CVE-2026-64849 info:...

Debug Endpoint pprof - Exposure Detection

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...

Brother MFC-L9570CDW - Information Disclosure

An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...

Netgear R6850 - Information Disclosure

Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the currentsetting.htm page.This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as firmware version, model details,...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

Ech0 < 4.2.8 - Server-Side Request Forgery

Ech0 before 4.2.8 exposes an unauthenticated SSRF vulnerability in GET /api/website/title. The websiteurl query parameter is fetched server-side without validating the target host or IP address. id: CVE-2026-35037 info: name: Ech0 4.2.8 - Server-Side Request Forgery author: fineman999 severity:...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

CVE-2026-63077

개요 • 시각적 흐름 • 요구 사항 • 사용법 • 제한 사항 • 완화 조치 !CAUTION 이 PoC는 운영체제 명령을 실행하며 TeamCity 애플리케이션 디렉터리를 수정할 수 있습니다. 격리된 실습 환경 또는 명시적인 서면 승인을 받은 시스템에서만 사용하세요. ⚡ 개요 JetBrains는 수정 버전 이전의 모든 TeamCity On-Premises 릴리스가 영향을 받는다고 밝혔습니다. 가능하면 현재 지원되는 릴리스로 업그레이드하세요. 즉시 업그레이드가 불가능하면 공급업체의 보안 패치 플러그인에 대한 지침을 따르세요. !NO...

CVE-2026-3844

root@kitploit: ╔════════════════════════════════════════════════════════════╗ ║ CVE-2026-3844 ║ ║ Breeze Cache = 2.4.4 Arbitrary File Upload ║ ║ Unauthenticated RCE | Authorized Lab Use Only ║ ╚════════════════════════════════════════════════════════════╝ 개요 CVE-2026-3844는 취약한 버전의 Breeze Cache...

cve-2025-0282-ivanti_rce_reproduction

CVE-2025-0282 — Ivanti Connect Secure / Policy Secure / ZTA 网关栈缓冲区溢出远程代码执行漏洞 CVSS 9.0 — 严重 | 已遭主动利用的零日漏洞 | 2025年1月发现 概述 CVE-2025-0282 是 Ivanti Connect Secure ICS、Ivanti Policy Secure IPS 和 Ivanti ZTA 网关中 IFT/TLS 处理组件的一个栈缓冲区溢出漏洞 CWE-121 / CWE-787。该漏洞允许未经身份验证的远程攻击者在目标设备上以 root 权限实现任意代码执行 。 该漏洞于 202...

CVE-2024-24919---Poc

CVE-2024-24919 PoC CVE-2024-24919 的概念验证 了解更多 - https://nvd.nist.gov/vuln/detail/CVE-2024-24919 该漏洞允许未经身份验证的远程攻击者读取受影响设备上任意文件的内容。 描述 可能允许攻击者在Check Point安全网关上读取某些信息，前提是网关已连接到互联网并启用了远程访问VPN或移动访问软件刀片。 Nuclei Template:...

Tenda-F3-V4

Эксплойт и загрузчик файлов для маршрутизатора Tenda F3 Этот проект представляет собой инструмент для загрузки различных файлов с маршрутизатора Tenda F3 v3/v4 через неавторизованную уязвимость CVE-2020-35391. Он позволяет получить конфигурационный файл, системный журнал и дамп флэш-памяти с...

CVE-2023-20887

CVE-2023-20887 CVE-2023-20887 的概念验证 - VMWare Aria Operations for Networks（vRealize Network Insight）未授权远程代码执行 技术分析 漏洞的根本原因分析可在我的博客中找到： https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ 概述 当通过 Apache Thrift RPC 接口接受用户输入时，VMWare Aria Operations for Networks（vRealize...

CVE-2025-55182-analysis

Análise Técnica do CVE-2025-55182: Minha Jornada de Pesquisa ⚠️ Aviso Importante Este documento descreve meu processo pessoal de pesquisa sobre o CVE-2025-55182, incluindo descobertas confirmadas e experimentos que realizei. Este é um relato honesto da minha investigação, incluindo suposições...

CVE-2025-27520

CVE-2025-27520 CVE-2025-27520的利用程序。BentoML最新版本（v1.4.2）中存在一个由不安全反序列化引起的远程代码执行（RCE）漏洞。它允许任何未经身份验证的用户在服务器上执行任意代码。该漏洞存在于serde.py中的一个不安全代码段。此漏洞已在1.4.3版本中修复。...

CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 ist eine nicht authentifizierte SQL-Injection-Schwachstelle SQLi, die das Plugin WP Ticket Customer Support Ticket System & Helpdesk für WordPress bis einschließlich Version 6.0.4 betrifft. Der Fehler entsteht, weil das Plugin den WordPress-Suchparameter s direkt in ei...

CVE-2025-11371

CVE-2025-11371 概要 このリポジトリには、Gladinet CentreStack および TrioFox における未認証のローカルファイルインクルージョン（LFI）脆弱性である CVE-2025-11371 の概念実証エクスプロイトが含まれています。このエクスプロイトにより、Web.config などの機密システムファイルをリモートで取得でき、マシンキーが露出することで、CVE-2025-30406 のようなデシリアライゼーションの欠陥を介したさらなる RCE につながる可能性があります。 影響を受けるバージョン: 16.7.10368.56560 までのすべてのバージョ...