CVE-2026-76060

An authenticated OS command injection vulnerability in ZoneMinder's event export functionality allows any user with View Events permission to execute arbitrary commands on the server. The exportFile HTTP parameter is passed unsanitized into a shell command executed via PHP's exec() , enabling ful...

EUVD-2026-67311

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

Drupalgeddon2

CVE-2018-7600 | Drupal 8.5.x 8.5.1 / 8.4.x 8.4.6 / 8.x 8.3.9 / 7.x? 7.58 / 6.x? - 'Drupalgeddon2' RCE SA-CORE-2018-002 Drupalggedon2 https://github.com/dreadlocked/Drupalgeddon2/ https://www.drupal.org/sa-core-2018-002 Unterstützt: Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL, Angriff auf...

react2shell

React2Shell CVE-2025-55182 Next.js: CVE-2025-66478 RCE non autenticato nei React Server Components Flight Protocol - Exploit PoC Descrizione I React Server Components protocollo Flight deserializzano multipart/form-data controllato dall'attaccante senza convalidare l'accesso alla catena dei...

social_mapper

Social Mapper Questo strumento non è più mantenuto attivamente, parti di esso potrebbero ancora funzionare e accetterò pull request per mantenerlo aggiornato ATTENZIONE: FACEBOOK ORA RILEVA QUESTO DOPO QUALCHE CENTINAIO DI RICERCHE, USA SOLO ACCOUNT FACEBOOK MONOUSO Uno strumento di mappatura dei...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 Inspiriert von https://github.com/dreadlocked/Drupalgeddon2 Unterstützt: Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL, Angriff auf account/mail & postrender Parameter, unter Verwendung der PHP-Funktion...

scan_CVE-2020-29583

Scanner für Zyxel-Produkte, die aufgrund eines undokumentierten Benutzerkontos verwundbar sind CVE-2020-29583 Details zur Schwachstelle: https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html Ich bin mir aber nicht sicher, ob ein Login mit zyfwp über die Web-Oberfläche...

XPKeygen

XPKeygen Windows XP / Windows Server 2003 VLK कुंजी जनरेटर। यह टूल आपको रॉ प्रोडक्ट कुंजी के आधार पर मान्य Windows XP कुंजियाँ उत्पन्न करने की सुविधा देता है, जो यादृच्छिक हो सकती है। रॉ प्रोडक्ट कुंजी RPK 9 अंकों XXX-YYYYYY के रूप में दी जाती है और यह केवल Windows XP कुंजी उत्पन्न करने के लिए...

CVE-2026-54713

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-54687

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37065

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...

CVE-2026-37004

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-35869

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

BlobRunner

BlobRunner BlobRunner ist ein einfaches Werkzeug, um Shellcode, der während der Malware-Analyse extrahiert wurde, schnell zu debuggen. BlobRunner reserviert Speicher für die Zieldatei und springt zur Basis oder einem Offset des reservierten Speichers. Dies ermöglicht es einem Analysten, mit...

CVE-2026-3844-Lab

CVE-2026-3844 — Breeze Cache: Lab für nicht authentifizierten beliebigen Datei-Upload zu RCE Reines lokales Docker-Lab zur Reproduktion und zum Vergleich des Verhaltens von CVE-2026-3844 im WordPress-Breeze-Cache-Plugin. Dieses Repository demonstriert das verwundbare Verhalten in Breeze Cache 2.4...