zimbramail-CVE-2025-68645-poc

zimbramail-CVE-2025-68645-poc Ein Proof-of-Concept, der eine Local File Inclusion LFI Sicherheitslücke ausnutzt, die in der Webmail Classic UI von Zimbra Collaboration ZCS 10.0 und 10.1 aufgrund unsachgemäßer Handhabung vom Benutzer bereitgestellter Anfrageparameter im RestFilter-Servlet existier...

Project-CVE-2026-33017

Script Langflow CVE-2026-33017 — Spiegazione del Codice codificato da: Xer0TLabs x Persephrak Decentralized Syndicate Scopo di questo documento Questo documento è una spiegazione di alto livello del programma Python fornito, per revisione, risposta agli incidenti e analisi difensiva...

CVE-2026-82250

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

CVE-2026-82236

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...

CVE-2026-81732

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts...

CVE-2026-78072

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded 5.6.1...

ALPINE-CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

ALPINE-CVE-2026-40019

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the...

CVE-2026-40019

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the...

CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

ALPINE-CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

CVE-2025-3248-Langflow-RCE

CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution Proof-of-Concept-Exploit für CVE-2025-3248 , eine nicht authentifizierte Remote-Codeausführungs-Schwachstelle in Langflow, einer Plattform zum Erstellen von KI-/LLM-Workflows. Betroffene Versionen: Langflow 1.3.0 Behoben in: 1.3.0...

CVE-2019-15107-Webmin-RCE-PoC

CVE-2019-15107 Webmin RCE PoC Un exploit proof-of-concept in Python per CVE-2019-15107 - una vulnerabilità di esecuzione remota di codice non autenticata in Webmin versioni 1.890 fino a 1.920. Descrizione Questa vulnerabilità risiede nell'endpoint /passwordchange.cgi di Webmin e consente a utenti...

CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Upload Arbitrario di File Non Autenticato → RCE PoC per CVE-2026-32475 CVSS 9.0 Critico, CWE-434: un upload arbitrario di file non autenticato nel modulo Forms di Elementor Pro che porta all'esecuzione remota di codice. Corretto in Elementor Pro 4.2.2...

CVE-2022-0739-Exploitation

CVE-2022-0739-Exploitation Uno sfruttamento di CVE-2022-0739. Riguarda il plugin WordPress BookingPress precedente alla versione 1.0.11. Utilizzando l'azione AJAX bookingpressfrontgetcategoryservices disponibile per utenti non autenticati, si ottiene un'iniezione SQL non autenticata. Poiché il...

WordPress Everest Forms plugin <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability

Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability discovered by h0xilo in WordPress Plugin Everest Forms versions = 3.4.4...

React2Shell-CVE-2025-55182

CVE-2025-55182 — React2Shell RCE non autenticata nei React Server Components tramite deserializzazione insicura del protocollo Flight. Una singola richiesta HTTP è sufficiente per eseguire codice arbitrario sul server — nessuna credenziale, nessun accesso precedente necessario. root@kitploit: / /...

CVE-2026-23744-RCE

MCPJam Inspector v1.4.2 - Exploit RCE Descrizione della vulnerabilità MCPJam Inspector contiene una vulnerabilità di Esecuzione Remota di Codice RCE non autenticata nell'endpoint /api/mcp/connect. La vulnerabilità consente agli aggressori di eseguire comandi arbitrari inviando un payload di...

CVE-2023-20887

CVE-2023-20887 POC für CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight nicht authentifizierte RCE Technische Analyse Eine Root-Cause-Analyse der Schwachstelle finden Sie in meinem Blog:...