CVE-2026-46817

🚨 CVE-2026-46817 - Critical Remote Code Execution Oracle E-Business Suite – Oracle Payments File Transmission Critical unauthenticated remote vulnerability affecting Oracle Payments File Transmission that may allow complete compromise of the application over HTTP. 📌 Overview CVE-2026-46817 is a...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — AshAuthentication OAuth2/OIDC Account Takeover Proof of Concept for CVE-2026-49757 — a critical vulnerability in AshAuthentication where OAuth2/OIDC callbacks resolved to local user accounts by email address instead of the strategy, sub identity pair, allowing unauthenticated...

FUXAPWN

CVE-2026-25895 — FUXA = 1.2.9 Unauthenticated Path Traversal to Remote Code Execution Unauthenticated, pre-auth arbitrary file write against FUXA, a Node.js-based SCADA/HMI platform. Chains to remote code execution via several distinct post-write primitives. Works even when secureEnabled = true...

wp2shell-poc

wp2shell-poc Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory. This repository is not Searchlight Cyber's official checker. check confirms the SQLi path, read demonstrates database read, a...

CVE-2026-9254

TP-Link Archer BE800 V1 — Parental Control LAN RCE CVE: CVE-2026-9254 CVSS: 8.7 High Auth required: None Network position: LAN only Found on version 1.3.2 Build 20251015 rel.106595553 Summary The parental control blocking endpoint /cgi-bin/luci/blocking?form=vercode is reachable from the LAN...

CVE-2019-15107

CVE-2019-15107 Python Exploit The exploit for CVE-2019-15107 webmin Acknowledgments Based on Metasploit module https://www.exploit-db.com/exploits/47230 Original advisory: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html...

CVE-2019-16097

CVE-2019-16097-batch Disclaimer Only for security research purposes. Do not use for illegal testing. You bear all consequences!!! CVE-2019-16097-batch Batch vulnerability exploitation script Add target addresses in batch to the url.txt file http://1.1.1.1 http://2.2.2.2 Run this script with Pytho...

Blackash-CVE-2025-0282

Blackash-CVE-2025-0282 Description A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution...

cve-2026-63030-lab

CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in WordPress Core via REST API Batch Route Confusion + SQL Injection Overview wp2shell is a chain of two independently low-severity bugs in WordPress core that, when combined, allow an unauthenticated remote attacker to: 1. Reach an SQL injecti...

CVE-2024-0235-PoC

CVE-2024-0235-PoC The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog Usage: usage: CVE-2024-0235.py -h --url URL CVE-2024-0235.py: error:...

cve-2024-10914-port

CVE-2024-10914 ported to rust and python because why not what is this cve-2024-10914 is a recently discovered 9.8 critical score vulnerability that affects some dlink routers. because those routers reached their eol support, dlink refuses to patch this vulnerability because "stop being poor and...

CVE-2024-3673

CVE-2024-3673 CVE-2024-3673 Exploit: Local File Inclusion in Web Directory Free WordPress Plugin before 1.7.3 Overview CVE-2024-3673 describes a critical vulnerability in the Web Directory Free WordPress plugin versions prior to 1.7.3. The plugin fails to validate a parameter before using it in a...

CVE-2023-38646

CVE-2023-38646 Original script from securezeron During testing, I found that the reverse shell generated by this POC failed due to the trailing '=' character after base64 encoding. I made a slight modification to fix this issue. Original reverse shell payload generation code base64.b64encode"bash...

Apache-RocketMQ-CVE-2023-33246-

CVE-2023-33246: Apache RocketMQ Remote Code Execution OVERVIEW Apache RocketMQ is one of the most popular and widely used distributed messaging and streaming platforms. A command execution vulnerability has been recently reported in Apache RocketMQ affecting version 5.1.0 and below. A remote...

CVE-2022-22963

CVE-2022-22963 Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment. Overview CVE-2022-22963 is a Spring Cloud Function vulnerability involving the spring.cloud.function.routing-expression header. Under vulnerable configurations, a...

CVE-2026-76904

GeoServer SQL Injection to RCE Zero-Day CVE: CVE-2026-76904 | CVSS: 9.8 Critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H This vulnerability has been assigned GHSA-mqjf-5f49-2fjh by the GeoServer/GeoTools team and is actively being exploited in the wild as of August 2026. The vulnerability ha...

WSUS-CVE-2025-59287-RCE

WSUS-CVE-2025-59287-RCE CVE-2025-59287 is a critical CVSS 9.8 remote code execution vulnerability affecting ALL Microsoft Windows Server Update Services aka WSUS, and has been exploited in the wild. The vulnerability exploits insecure deserialization in the GetCookie endpoint, allowing...

CVE-2025-13407

CVE-2025-13407 GravityForms 2.9.23.1 - Unauthenticated Arbitrary File Upload TELEGRAM GROUP ADRESS: https://t.me/toolsandpoc...

CVE-2024-23692

Rejetto HTTP File Server HFS Unauthorized RCE Vulnerability Reproduction CVE-2024-23692 Introduction Rejetto HTTP File Server HFS is a lightweight HTTP file server widely used for file sharing and file transfer. CVE-2024-23692 is a template injection vulnerability that allows a remote,...

CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Injects Arbitrary JavaScript via Crafted Price Filter URL SUMMARY PhocaCart 6.1.7 for Joomla is vulnerable to Reflected Cross-Site Scripting XSS via the pricefrom and priceto GET...