Netgear R6850 V1.1.0.88 - Command Injection

Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the pingtest functionality. An unauthenticated attacker can inject arbitrary system commands through the c4IPAddr parameter, resulting in remote code execution as root. id: CVE-2024-30568 info: name:...

PyArrow Flight RPC - Remote Code Execution

PyArrow Flight RPC from v0.14.0 through v14.0.0 allows remote attackers to execute arbitrary code via a maliciously crafted Python-defined extension type. id: CVE-2023-47248 info: name: PyArrow Flight RPC - Remote Code Execution author: smolse severity: critical description: | PyArrow Flight RPC...

LG Simple Editor <= v3.21.0 - Command Injection

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within t...

Bitrix Component - Cross-Site Scripting

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim ha...

OpenSymphony XWork/Apache Struts2 - Remote Code Execution

Apache Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language OGNL expression when altSyntax is enabled, which allows remote attackers to cause a denial of service infini...

mooSocial v.3.1.8 - Cross-Site Scripting

Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. id: CVE-2023-44813 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha severity:...

TimeKeeper by FSMLabs - Remote Code Execution

An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named argx, with x an integer starting from 1; it is possible t...

FUXA - Unauthenticated Remote Code Execution

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2023-33831 info: name: FUXA - Unauthenticated Remote Code Execution author: gy741 severity: critical description: | A remot...

PaperCut < 22.1.3 - Path Traversal

PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files. id: CVE-2023-39143 info: name: PaperCut 22.1.3 - Path Traversal author: pdteam severity: critical description: PaperCut NG and PaperCut MF before 22.1.3...

Rudder Server < 1.3.0-rc.1 - SQL Injection

Rudder-server is part of RudderStack, an open source Customer Data Platform CDP. Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution RCE due to the rudder role in PostgresSQL having superuser permissions by default. Version...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution

SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the systemlog.cgi page. id: CVE-2020-17456 info: name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution author: gy741,edoardottt severity: critical description: SEOWON INTECH...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL注入到远程代码执行 概述 CVE-2024-50330 是 Ivanti Endpoint Manager EPM 中存在的一个严重 的预认证 SQL 注入漏洞，允许远程未认证攻击者在目标服务器上实现远程代码执行。该漏洞已于2024年11月的安全更新中披露并修复。 技术细节 CVE ：CVE-2024-50330 CWE ：CWE-89（SQL注入） CVSS ：严重（CVSS 3.x 评分约9.8） 攻击向量 ：网络 认证 ：不需要 影响 ：远程代码执行 该漏洞存在于 Ivanti EPM W...

Joomla-3.4.6---configuration.php-Remote-Code-Execution

Joomla-3.4.6---configuration.php-Remote-Code-Execution Betroffene Versionen: 3.0.0-3.4.6 1. Schwachstellenvalidierung python3 Joomla-3.4.6-RCE.py -t http://172.20.10.4 Wird „Vulnerable“ angezeigt, ist die Schwachstelle vorhanden. python3 test.py -t http://127.0.0.1:8080/ --exploit --lhost...

cve-2024-4367-PoC-fixed

cve-2024-4367-PoC-fixed PDF.js ist ein von Mozilla gepflegter, auf JavaScript basierender PDF-Viewer. Diese Schwachstelle erlaubt es Angreifern, unmittelbar nach dem Öffnen einer schädlichen PDF-Datei beliebigen JavaScript-Code auszuführen. Dies betrifft alle Firefox-Benutzer 126, da Firefox PDF....

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 详情 此概念验证漏洞利用程序仅针对 macOS 10.13.3 17D47 上的 Safari 11.0.3 13604.5.6 版本。 将你选择的有效载荷编译为带有构造函数的动态库 dylib 运行 python filetojsarray.py your.dylib payload.js 提供此目录服务，并将 Safari 指向 /exploit.html 该漏洞利用并非完全可靠，并且为此 macOS/Safari 版本使用了硬编码偏移量。...

CVE-2018-17553

CVE-2018-17553 CVE-2018-17553 PoC（Navigate CMS 版本 2.8 及更早版本） 此概念验证（PoC）是在处理 TCM 的 Black Pearl 靶机时编写的。除了使用 Metasploit 之外，我找不到其他人发布过 PoC。由于我在黑客学习之旅中避开了 Metasploit（计划之后再用它重新做一遍所有内容），所以我快速整理了此 PoC，供其他处于相同处境的人使用。 此 PoC 假设您已经手动利用了 CVE-2018-17552 获取了访问权限（或者通过其他方式获得了访问权限）。 目前，该脚本不会对您的输入进行任何验证，也不会对 cURL...