CVE-2024-48914

This post is a research article published by EQSTLab. Thanks toRajesh Sharma, who discovered this vulnerability. CVE-2024-48914 ★ CVE-2024-48914 Arbitrary File Read and DoS PoC ★ Description CVE-2024-48914 : vendure-ecommerce Arbitrary file read and DoS Vulnerability description: Vendure is an...

CVE-2024-5932

Esta publicación es un artículo de investigación publicado por EQSTLab. ❗❗ IMPORTANTE ❗❗ Actualmente existen repositorios falsos de PoC en GitHub que ejecutan xmrig. Consulte el siguiente enlace para obtener más información : URL1: https://x.com/win3zz/status/1828704644987511107 URL2:...

CVE-2025-48384-poc

CVE-2025-48384-poc CVE-2025-48384 se presenta como una vulnerabilidad de resolución de enlace incorrecta seguimiento de enlaces en git. Específicamente, los nombres de archivo con retornos de carro se analizan incorrectamente en .git/config, e incluir un enlace simbólico para apuntar a un...

CVE-2024-3400

CVE-2024-3400 Description A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code...

CVE-2025-1562

CVE-2025-1562 POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124 Safari/537.36...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Arbitrary Post Deletion Overview A critical authorization flaw was identified in the WordPress plugin Frontend File Manager nmedia-user-file-uploader affecting versions = 23.6. The vulnerability allows authenticated users with low...

CVE-2025-59213

Microsoft Configuration Manager ConfigMgr / SCCM 2503 Unauthenticated SQL injection CVE-2025-59213 exploit This script exploits the CVE-2025-59213 vulnerability, which allows an unauthenticated attacker with network access to a Management Point to execute arbitrary SQL queries on the site databas...

CVE-2021-43798

CVE-2021-43798 1. Resumen Grafana es una plataforma de código abierto que soporta funciones de monitoreo y gestión de datos. En las versiones siguientes existe una vulnerabilidad de Path Traversal que permite manipular la ruta de archivos mediante caracteres especiales como ../. 8.0.0 y...

CVE-2019-12725

CVE-2019-12725 ZeroShell contiene una vulnerabilidad de ejecución de comandos que permite a un atacante ejecutar comandos arbitrarios Uso de la herramienta python3 CVE-2019-12725.py -u http://127.0.0.1:1111 Prueba de URL individual python3 CVE-2019-12725.py -c http://127.0.0.1:1111 Modo cmdshell...

EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin es una vulnerabilidad de tiempo de verificación a tiempo de uso en el protocolo MS-EVEN. La vulnerabilidad permite a usuarios con bajos privilegios escribir archivos arbitrarios en una máquina remota, evitando efectivamente la necesidad de una cuenta de...

CVE-2023-24489-ShareFile

ShareFile RCE CVE-2023-24489 Este es un script en Python que explota una vulnerabilidad de ejecución remota de código en la aplicación ShareFile CVE-2023-24489. Esta vulnerabilidad permite a un atacante ejecutar comandos arbitrarios en el sistema objetivo. Uso Para usar el script, siga las...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278

The File Media Renamer WordPress plugin (versions

WordPress File Media Renamer plugin <= 1.3 - Author+ Arbitrary File Rename vulnerability

Author+ Arbitrary File Rename vulnerability discovered by Sebastian Riveros in WordPress Plugin File Media Renamer versions = 1.3...

CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

EUVD-2026-92966

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

CVE-2019-16941

CVE-2019-16941 Proof-of-Concept: The vulnerability requires multiple and relatively improbable conditions in order to get triggered, fact that limits its exploitability. However, it takes little effort and understanding to prepare a payload given the fact that it can result into an arbitrary code...

CVE-2024-34102

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapikk for the original code base. ★ Description CVE-2024-34102 : Adobe Commerce XXE vulnerability description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

SysmonEoP

SysmonEoP Proof of Concept for arbitrary file delete/write in Sysmon CVE-2022-41120/CVE-2022-44704 Vulnerability Vulnerability is in code responsible for ClipboardChange event that can be reached through RPC. Local users can send data to RPC server which will then be written in C:\Sysmon director...