GHSA-VHHV-V3M2-WVQF vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-6W89-9JRV-4J59 vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-84QV-4WJ5-WWMM vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2025-59287-WSUS-2

CVE-2025-59287 ⚠ Esta herramienta se crea únicamente con fines educativos. El uso no autorizado fuera de entornos controlados está estrictamente prohibido. CVE-2025-59287 es una vulnerabilidad crítica de ejecución remota de código en Microsoft Windows Server Update Services WSUS. Se origina por u...

CVE-2026-52762

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

PT-2026-86409

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP ENV is not production. Attackers can request the GET /screenshot-login/email endpoint with a registered ema...

Debian dla-4773 : libssh2-1 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4773 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4773-1 [email protected]...

PT-2026-86396

Name of the Vulnerable Software and Affected Versions Axolotl versions prior to 0.18.1 Description A remote code execution issue exists in the multipack patch path. The security guard is bypassed because the trust remote code variable defaults to None instead of False. An attacker can execute...

PT-2026-86312

Name of the Vulnerable Software and Affected Versions Hummingbird versions prior to 3.21.1 Description Remote Code Execution is possible via the log msg function in core/modules/class-page-cache.php. The page-cache debug log is written to a web-accessible PHP file that fails to maintain a...

PT-2026-86406

Name of the Vulnerable Software and Affected Versions Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails versions prior to 1.31.1 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input within the handle form submission...

PT-2026-86395

Name of the Vulnerable Software and Affected Versions AutoAgent affected versions not specified Description An unauthenticated remote code execution issue exists in the TCP server that binds to all interfaces. This allows an attacker to connect to the exposed communication port and execute...

PT-2026-86327

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.2 Description PHP Object Injection occurs due to the deserialization of untrusted input within the Telecom EDY payment callback usces action acting transaction. Unauthenticated...

chall.stypr.com

chall.stypr.com Gracias por jugar en chall.stypr.com Han pasado nueve años desde que configuré y alojé por primera vez mi wargame. Muchos CTF ya han reutilizado o creado desafíos similares, así que he decidido compartir el código fuente de todos los desafíos y las configuraciones utilizadas para...

CVE-2026-52762

YesWiki (PHP wiki system) prior to version 4.6.6 is affected by a stored Server-Side Template Injection (SSTI) in the Bazar semantic template feature. An authenticated administrator can inject arbitrary Twig expressions into the bn_sem_template field, which are later executed server-side via Temp...

CVE-2026-52762 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

CVE-2026-52762 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

cve-2026-75604

CVE-2026-75604 - Path traversal en Next.js → RCE Windows · laboratorio de investigación Laboratorio de reproducción y herramientas de explotación para CVE-2026-75604 , un path-traversal no autenticado en la caché incremental de Next.js que afecta a hosts con Windows. Una única barra invertida sin...

CVE-2026-4813

CVE-2026-4813 CVSS-B 9.4 CRÍTICO RCE autenticado mediante inyección XSLT en Lutece Core Explicaciones y más en mi sitio web...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Exploit de RCE no autenticado en Langflow 📋 Descripción general CVE-2026-33017 es una vulnerabilidad de Ejecución Remota de Código RCE no autenticada en versiones de Langflow Este exploit es solo para fines educativos y de pruebas autorizadas. El acceso no autorizado a sistemas...

SSH-Remote-Code-Execution

SSH Remote Code Execution SSH Zero-Day | Made by ClumsyLulz & Taylor Christian Newsome Summary This repository contains a C program that accepts input parameters and generates a packet to be sent to a server over the SSH protocol. The program allocates a buffer to hold the data, writes it to a...