CVE-2026-14494

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

CVE-2020-14181

CVE-2020-14181 Poc für CVE-2020-14181 Betroffene Versionen von Atlassian Jira Server und Data Center erlauben es einem nicht authentifizierten Benutzer, Benutzer über eine Schwachstelle zur Offenlegung von Informationen im Endpunkt /ViewUserHover.jspa aufzulisten. Diese Schwachstelle wurde von...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

EUVD-2026-68097

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448

Shinobi (a self-hosted CCTV/surveillance platform) contains a hardcoded connection key in its child node service prior to commit 5a76c74f . An unauthenticated attacker who can reach the child node port can present this key during the WebSocket handshake and then dispatch arbitrary SQL queries thr...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-33137

CVE-2026-33137 XWiki Platform – Nicht authentifizierter XAR-Import via REST/wikis/wikiName Beschreibung Der REST-API-Endpunkt POST /wikis/wikiName in der XWiki-Plattform führt einen XAR-Import XWiki-Archiv durch, ohne dabei eine Authentifizierungs- oder Autorisierungsprüfung vorzunehmen. Ein nich...

omigod-lab

Readme Una VM di laboratorio educativa per apprendere la vulnerabilità di esecuzione remota di codice RCE non autenticata con punteggio CVSS 9.6 nel software Open Management Infrastructure CVE-2021-38647. Divulgazione ricerca originale:...

CVE-2025-32433_Erlang-OTP_PoC

CVE-2025-32433Erlang-OTP Dieses Skript ist ein benutzerdefiniertes Sicherheitstool, das entwickelt wurde, um auf eine kritische Pre-Authentifizierungs-Schwachstelle in Systemen zu testen, die auf Erlang-basierten SSH-Servern laufen Dieses Skript ist ein benutzerdefiniertes Sicherheitstool, das...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL-Injection-Schwachstelle im Drupal Core Hochwirksame SQL-Injection-Schwachstelle im Drupal Core PostgreSQL 📋 Übersicht CVE-2026-9082 ist eine SQL-Injection -Schwachstelle in der Datenbank-Abstraktionsschicht von Drupal Core. Sie betrifft nur Websites, die PostgreSQL als...

CVE-2026-34234-Lab

CVE-2026-34234 - Lab RCE dell'Installer CtrlPanel Lab Docker locale per dimostrare CVE-2026-34234 in CtrlPanel. Questo repository confronta: vuln: CtrlPanel 1.1.1 bloccata tramite digest patched: CtrlPanel 1.2.0 bloccata tramite digest Il lab è esclusivamente locale e vincola i servizi a 127.0.0....

CVE-2026-14494 Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

EUVD-2026-68094

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

CVE-2024-8529

CVE-2024-8529 LearnPress – Plugin LMS per WordPress = 4.2.7 - SQL Injection non autenticata tramite 'cfields' Descrizione Il plugin LearnPress – WordPress LMS Plugin per WordPress è vulnerabile a SQL Injection tramite il parametro 'cfields' dell'endpoint API REST...

cve-2021-21425

Exploit für: GravCMS 1.10.7 - Beliebiges YAML Schreiben/Aktualisieren Unauthentifiziert Verwendung: root@kitploit: python3 exploit.py --url http://192.168.204.12/grav-admin Erwartetes Verhalten Verwenden Sie diesen Exploit nicht auf Systemen, für die Sie nicht autorisiert sind! Frohes Hacken...

CVE-2022-46169

Cacti | Bypass dell'autenticazione | RCE | CVE-2022-46169 Cacti: Exploit di esecuzione remota di codice non autenticato in Ruby Cacti Docker Questa è un'applicazione dockerizzata vulnerabile alla vulnerabilità RCE di Cacti CVE-2022-46169. Segui il link per avviare Cacti root@kitploit:...

CVE-2024-48887-Exploit

CVE-2024-48887-Cambio di Password non Verificato CWE-620 Panoramica Una vulnerabilità di cambio password non verificato nell'interfaccia GUI di Fortinet FortiSwitch che consente a un attaccante remoto non autenticato di modificare le password degli amministratori tramite una richiesta appositamen...

CVE-2021-43798

CVE-2021-43798 Grafana-Arbitrary-File-Read 8.0.0 8.3.0 Una vulnerabilità in Grafana CVE-2021-43798 versioni 8.0.0 8.3.0 che consente a un attaccante non autenticato di leggere file arbitrari dal server sfruttando un path traversal rivolto al percorso /public/plugins/ per accedere a file sensibili...

CVE-2025-57819_FreePBX

🛡️ CVE-2025-57819 – FreePBX Unauthentifizierte SQL-Injection zu RCE PoC Dieses Repository enthält zwei Python-Proof-of-Concept-Skripte PoC, die sich gegen CVE-2025-57819 richten, eine kritische unauthentifizierte SQL-Injection-Schwachstelle in FreePBX. 🧠 Über die Schwachstelle CVE-2025-57819...