Yealink DM Command Injection RCE (CVE-2021-27561)

Exploits CVE-2021-27561 in Yealink Device Management 3.6.0.20: unauthenticated command injection via /sm/api/v1/firewall/zone/services zone parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink DM firewall zone command injection CVE-2021-27561.""" import re import urllib.parse from...

Cisco SD-WAN Manager Auth Bypass (CVE-2026-76504)

Exploits CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: POST to a percent-encoded /jsecuritycheck path bypasses WildFly authentication constraints and yields an admin-level JSESSIONID, enabling full vManage API access and device template deployment. !/usr/bin/env python3 -- coding: utf-8 --...

Flowise NVIDIA NIM Auth Bypass (CVE-2026-30824)

Exploits CVE-2026-30824 in Flowise 3.0.13: /api/v1/nvidia-nim/ routes are whitelisted in auth middleware, allowing unauthenticated token generation and container management API access. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise NVIDIA NIM auth bypass token leak CVE-2026-30824.""" import...

Langflow Broken Access Control (CVE-2026-21445)

Exploits CVE-2026-21445 in Langflow 1.7.0.dev45: unauthenticated access to /api/v1/monitor/messages and related monitor endpoints exposes user conversation data and allows destructive operations without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """Langflow broken access control on...

TeamCity Auth Bypass Admin Creation (CVE-2024-27198)

Exploits CVE-2024-27198 in JetBrains TeamCity: alternate servlet path /hax?jsp=/app/rest/... bypasses authentication to create an administrator account via the REST users API. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity authentication bypass admin creation CVE-2024-27198."""...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...

Ivanti EPMM Authentication Bypass (CVE-2023-35078)

Exploits CVE-2023-35078 in Ivanti Endpoint Manager Mobile EPMM: unauthenticated access to /mifs/aad/api/v2/admins/users allows reading admin accounts and creating a new local administrator. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM unauthenticated admin API access CVE-2023-35078.""...

Progress LoadMaster Command Injection (CVE-2026-8037)

Exploits CVE-2026-8037 unauthenticated OS command injection in Progress ADC LoadMaster /accessv2 JSON API via malformed g0-g15 fields WatchTowr pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster pre-auth command injection CVE-2026-8037.""" import json import re from...

Kemp LoadMaster Command Injection (CVE-2024-1212)

Exploits CVE-2024-1212 in Progress Kemp LoadMaster: unauthenticated command injection via /access/set?param=enableapi&value=... management API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster unauth command injection CVE-2024-1212.""" import re import urllib.parse from...

Drupal Drupalgeddon2 RCE (CVE-2018-7600)

Exploits CVE-2018-7600 in Drupal 7/8 via form API render array injection on /user/register mailpostrender=passthru for unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Drupalgeddon2 RCE CVE-2018-7600.""" import re from kittysploit import from lib.protocols.http.httpclient...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

GitLab Commits API file.path LFI (CVE-2026-85706)

Exploits CVE-2026-85706 in self-managed GitLab CE/EE: unauthenticated multipart POST to /api/v4/projects/id/repository/commits with attacker-controlled file.path reads arbitrary host files outside Workhorse temp directories. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab unauthenticated...

Exploit for CVE-2026-105314

Papermerge-core: Authenticated Path Traversal to Arbitrary Fil...

wp2shell

CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

CVE-2026-105307

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

Improper Privilege Management

Apache Syncope is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in certain user workflow configurations, which allows an authenticated user to grant themselves defined Roles through a REST API and gain their associated entitlements,...

CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2026-105307

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2026-105307

A vulnerability exists in Casdoor up to version 3.161.1 involving the API Endpoint component. The issue resides in the ApiFilter function located within the routers/authz_filter.go file, where a manipulation can lead to missing authentication . This flaw allows for remote attacks. While an exploi...