POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Arbitrary File Write + XML Injection → Remote Code Execution Table of Contents Overview Vulnerability Details Attack Chain Requirements Installation Configuration Usage How It Works Vulnerable Code Pre-Exploitation Checklist...

CVE-2023-24055_PoC

CVE-2023-24055 PoC KeePass 2.5x Under discussion and analysis... https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/ https://sourceforge.net/p/keepass/feature-requests/2773/ An attacker who has write access to the KeePass configuration file can modify it and inject malicious...

CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: Inyección de Comandos del SO en Router TP-Link Para más información, ver https://vulners.com/cve/CVE-2026-3227 Una vulnerabilidad persistente y autenticada de Inyección de Comandos del SO en el firmware de routers TP-Link que puede causar el brick del dispositivo o una posible toma...

Adobe Experience Manager ≤ 6.5.23.0 - XML Injection

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. id: CVE-2025-54251 info: name: Adobe Experience Manager ≤ 6.5.23.0 - XML Injection author: DhiyaneshDK,assetnote severity: medium description: |...

geoserver-

GeoServer CVE-2024-36401 Exploitation Tool GeoServer CVE-2024-36401 Environment: JDK8 Disclaimer: For authorized testing only. The author bears no responsibility for any consequences caused by user misuse. Please comply with laws and regulations! 1. Default payload: POST /geoserver/wfs HTTP/1.1...

CVE-2026-34197

CVE-2026-34197 Description Improper Input Validation, Improper Control of Generation of Code ‘Code Injection’ vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access polic...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib Escritura Arbitraria de Archivos → RCE Exploit PoC para una vulnerabilidad de Escritura Arbitraria de Archivos + Inyección XML enfontTools.varLib Probado en HackTheBox — VarIaType Vulnerabilidad fontTools.varLib procesa archivos XML .designspace para construir...

NodeBB XML-RPC Request xmlrpc.php - XML Injection

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. id: CVE-2023-43187 info: name: NodeBB XML-RPC Request xmlrpc.php - XML Injection author: 0xParth...

cve-2025-58360

GeoServer: CVE-2025-58360 Disclaimer The code and information contained within this repository is for educational and research purposes only. The owner of the repository takes no responsibility for anything you do with the code and/or information within this repository. Your actions are your own...

CVE-2026-89247

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

CVE-2026-89247

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection in plugin/AD_Server/VMAP.php, reachable without authentication when the AD_Server plugin is enabled. The timeOffset and idTag values from the base64- and JSON-decoded $_REQUEST['vmaps'] parameter ...

EUVD-2026-76059

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

CVE-2026-2310 IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

Zimbra Collaboration Suite - SSRF

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. id: CVE-2019-9621 info: name: Zimbra Collaboration Suite - SSRF author: riteshs4hu severity: high description: |...

Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat

Breaking-the-Update-Chain-Inside-CVE-2025-59287-and-the-WSUS-RCE-Threat CVE-2025-59287 is a critical RCE vulnerability in Windows Server Update Services WSUS caused by unsafe deserialization of untrusted data. It allows remote attackers to execute arbitrary code without authentication. Urgent...

CVE-2026-34197

CVE-2026-34197 Apache ActiveMQ Remote Code Execution via Jolokia API...

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...

EUVD-2026-69239

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed...

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for element and attribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose first line is well-formed slips past it and is serialized verbatim, so the characters after the...

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

Summary An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name validation. createElementNS, createAttributeNS, createDocumentType, and createAttribute should reject a malformed qualified name with InvalidCharacterError, but a name whose first line is well-form...