wp2shell-lab

wp2shell lab & detector + pre-auth RCE PoC A self-contained lab, non-destructive detector , and full pre-auth RCE proof-of-concept for wp2shell — the pre-authentication vulnerability chain in WordPress core: CVE| Component| Class| CVSS ---|---|---|--- CVE-2026-60137| WPQuery::authornotin| SQL...

CVE-2026-52806

Gogs RCE — Inyección de argumentos en git rebase CWE-88 Ejecución remota de código autenticada contra Gogs es interpretada por Git como el flag --exec en lugar de un argumento posicional, lo que provoca que sh -c se ejecute después de cada commit reproducido durante el rebase. Cómo funciona el...

CVE-2025-14847

MongoDB CVE-2025-14847 漏洞检测工具 MongoDB 内存泄露漏洞 CVE-2025-14847 检测工具 ⚠️ 重要提示：此工具仅用于授权的安全测试和漏洞评估。未经授权的使用可能违反法律。 📋 目录 Descripción de la vulnerabilidad Características Instalación Uso Configuración del entorno de pruebas Ejemplos de salida Principio de detección Recomendaciones de mitigación Descargo de...

cve-2019-3396

cve-2019-3396 RCE no autenticado en Confluence cve-2019-3396 configurar librerías del exploit bundle install ejecutar ┌──user㉿hostname-/path/to/cve-2019-3396 └─$ ruby cve-2019-3396.rb exploit - CVE-2019-3396 Autor - Abdallah Mohamed Elsharif Saludos a Ghost5egy, Hamza Abdulrahman, Omar y Alaa Uso...

masq

Sit where the model sits. See what it can see. MASQ MASQ is a local security CLI for AI agent stacks. It sits in the same seat the model sits in: it reads MCP tool catalogs, completes the MCP handshake, looks through session logs, and probes local model HTTP ports. Then it prints findings and...

CVE-2020-35729

Información Exploit Title: Klog Server 2.4.1 - Command Injection Unauthenticated Date: 22.12.2020 Exploit Author: b3kc4t Mustafa GUNDOGDU Vendor Homepage: https://www.klogserver.com/ Version: 2.4.1 Tested On: Ubuntu 18.04 CVE: 2020-35729 Description:...

CVE-2026-46454

camel-cometd Inbound Bayeux Header Injection Reproducer CVE-2026-46454 Este proyecto demuestra una inyección de cabeceras de mensaje en el componente camel-cometd de Apache Camel, registrada como CVE-2026-46454. El componente mapea las cabeceras de mensajes Bayeux CometD entrantes dentro del Came...

CVE-2026-33234

How I Turned AutoGPT's Email Feature Into an Internal Network Scanner CVE-2026-33234 | Moderate 5.0 | GHSA-4jwj-6mg5-wrwf Author: Pavan Nallamothu I was mapping every user-controlled input that touched the network in AutoGPT Platform. The HTTP layer was locked down tight. Private IP ranges...

evil-rmi-server

evil-rmi-server Un servidor RMI malicioso que puede lanzar un comando arbitrario. Puede ser útil para CVE-2021-44228 en un escenario local de escalada de privilegios. Construcción ./gradlew bootJar Ejecución Usage: java -jar build/libs/evilRMIServer-1.0-SNAPSHOT.jar -hV -p= An evil RMI Server to...

CVE-2026-57239

Foxit PDF Reader LPE Prueba de concepto para CVE-2026-3775/CVE-2026-3780 y CVE-2026-57239 que permite obtener derechos de NT AUTHORITY\SYSTEM mediante el servicio de actualización del lector de PDF de Foxit. Compilación Solo compila el binario, colócalo en tu objetivo y ejecútalo. cargo build...

CVE-2022-1388

Vuln Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. Vuln Product F5 BIG-IQ 11.6.1 - 11.6.5 F5 BIG-IP...

Malicious code in crypti-toolbox (RubyGems)

Source: amazon-inspector 5ec4d5d5915335d90b2f18b45b050936fa5d2db9d176d7d081bd8c292c7c6795 On gem install, the native extension script ext/crypti-toolbox/extconf.rb runs an environment-fingerprinting routine that bails out on CI runners, ephemeral/sandbox hostnames, generated or analysis-shaped...

Malicious code in blockchain-sync-utils (RubyGems)

Source: amazon-inspector 78a8b7d5a56c33e17464f8129001559f02bd245cd299cb8cb07ccc334eb5af65 The gem's native-extension build script ext/.../extconf.rb is a dropper rather than a real build step. The accompanying C source is a no-op stub, so the extension exists only to run install-time code. The...

Malicious code in css-nrmgzn-polyfill (npm)

Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami, uname, ifconfig, and cat /etc/hosts, and sends the comma...

Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.121 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and...

CVE-2026-49176_LPE_POC

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. Technical write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM. A standard user creates a Wallet ESE database containing a persisted callbac...

CVE-2026-54900

CVE-2026-54900, CVE-2026-54902 Donar Apoya el mantenimiento de este proyecto con PayPal o escaneando el código QR a continuación. ⚡ Uso sencillo Utiliza este proyecto solo en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones de laboratorio aislad...

BlueGate-CVE-2020-0609

RD Gateway BlueGate Validator CVE-2020-0609 / CVE-2020-0610 Remote Validation Tool A small check-only Python utility for remotely validating the patch behavior associated with the Microsoft Remote Desktop Gateway vulnerabilities: CVE-2020-0609 CVE-2020-0610 The vulnerabilities, commonly associate...

CVE-2026-103352 WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0...

CVE-2026-103352

The WP BASE Booking WordPress plugin (versions 6.4.0 and below ) is vulnerable to a Blind SQL Injection flaw. The root cause is the improper neutralization of special elements used in an SQL command. This vulnerability allows an attacker to potentially execute malicious SQL queries. No specific e...