CVE-2026-88418

CMSimple 5.24 is vulnerable to persistent remote code execution (RCE) due to disabled CSRF protection by default. The csrfProtection() function acts as a no-op on state-changing admin requests, and the csrf_token hidden field is missing from admin forms. Since authentication is cookie-only, an un...

EUVD-2026-84851

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

CVE-2026-88419

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

APSB26-151 : Security update available for Adobe Experience Manager Forms JEE

Adobe has released a security update for Adobe Experience Manager Forms on Java Enterprise Edition JEE. This update addresses critical vulnerabilities that could result in arbitrary code execution, privilege escalation, and security feature bypass...

APSB26-148 : Security update available for Adobe Bridge

Adobe has released a security update for Adobe Bridge. This update addresses critical and important vulnerabilities that could result in arbitrary code execution and memory exposure...

ROS-20260922-73-0002

The vulnerability in gstreamer1-plugins-base is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Important: postgresql:16 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: shim (UTSA-2026-091436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091436 advisory. There's a possible overflow in handleimage when shim tries to load and execute crafted EFI executables; The handleimage function takes into account the SizeOfRawData...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-054038)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054038 advisory. A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper...

Unity Linux 20.1070e Security Update: glibc (UTSA-2022-002147)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-002147 advisory. The deprecated compatibility function svcunixcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its path argument on the stack without...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091415)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091415 advisory. FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorph...

CVE-2025-24893

XWiki CVE-2025-24893 Доказательство концепции Авторы : Net.Doge & Infinit3i Этот скрипт на Python эксплуатирует уязвимость CVE-2025-24893 — удаленное выполнение кода RCE в XWiki, вызванное некорректной изоляцией Groovy-макросов, отображаемых асинхронно. Он позволяет выполнять произвольные команды...

text4shell-exploit

Text4shell-exploit Это Proof of Concept, эксплуатирующий уязвимость в Apache Commons Text CVE-2022-42889 Уязвимые версии: с 1.5.0 до не включая 1.10.0 Воздействие Успешная эксплуатация этой уязвимости позволяет неавторизованному злоумышленнику выполнить произвольный код на уязвимом активе Уязвимо...

CVE-2020-0688-Scanner

CVE-2020-0688-Scanner Быстрый инструмент на C для проверки CVE-2020-0688 на нескольких хостах неинтрузивным методом. Возможности Сканирование хостов из входного файла. Пассивная проверка: получение версии Exchange путем анализа HTML-содержимого. Создание выходного файла. Демонстрация Как...

pax

pax Exploit padding oracles for fun and profit! Pax PAdding oracle eXploiter is a tool for exploiting padding oracles in order to: 1. Obtain plaintext for a given piece of CBC encrypted data. 2. Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by...

CVE-2023-38831

CVE-2023-38831 CVE-2023-38831 is an RCE in WinRAR 6.23 Reference by https://github.com/z3r0sw0rd/CVE-2023-38831-PoC Read up by Google's TAG at: https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/ Download the latest vulnerable version: 6.22 for...

CVE-2024-4577

CVE-2024-4577 PoC-эксплойт Описание Этот репозиторий содержит PoC-эксплойт для CVE-2024-4577 — критической уязвимости, затрагивающей все версии PHP, работающие в Windows. Уязвимость позволяет злоумышленникам удалённо выполнять произвольный код. Ошибка также затрагивает среду разработки XAMPP,...

CVE-2017-3078

CVE-2017-3078 Description On CVE-2017-3078 Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Description 2 : Adobe...

CVE-2022-40471

CVE-2022-40471 Удалённое выполнение кода через уязвимость неограниченной загрузки файлов в Clinic's Patient Management System v 1.0 Техническое описание: Удалённое выполнение кода в Clinic's Patient Management System v 1.0 позволяет атакующему загрузить произвольный php-веб-шелл через функцию...

PDFkit-CMD-Injection

PDFkit-Внедрение-команд CVE-2022-25765 pdfkit 0.8.6 внедрение команд. Пакет pdfkit уязвим для внедрения команд, поскольку URL-адрес не подвергается должной санитизации. Примечание: Эта проблема была исправлена в версии 0.8.7.2, но исправление оказалось неэффективным. Обновлённая версия исправлени...