CVE-2026-59310-POC

CVE-2026-59310 — VMware vCenter Syslog 目录遍历导致未授权 RCE 免责声明 ：本项目仅用于授权 安全测试、漏洞验证与防御研究。请在获得明确书面授权的环境中使用。使用者需自行承担因滥用导致的一切后果。 目录 漏洞概述 影响版本 漏洞成因 利用链 环境与复现验证 脚本复现 检测与自查 修复建议 常见问题 参考链接 漏洞概述 项目| 内容 ---|--- 漏洞名称| VMware vCenter Syslog 目录遍历漏洞 漏洞编号| CVE-2026-59310 漏洞类型| 目录遍历（Path Traversal）→ 任意文件写入 → 远程代码执行...

CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea diffpatch Git Hook RCE PoC ★ https://github.com/user-attachments/assets/403a70f4-4ff4-4ab7-b11c-d73d70adaf0b Overview CVE-2026-60004 is a Remote Code Execution RCE vulnerability in Gitea. The diffpatch API applies a supplied patch with git...

CVE-2026-100888

A flaw was found in OpenDKIM. A remote attacker can exploit this flaw to cause a Denial of Service DoS or potentially arbitrary code execution by submitting a specially crafted DomainKeys Identified Mail DKIM signature header. In the dkimcanonselecthdrs function, improper processing of the 'h'...

CVE-2026-11561

CVE-2026-11561 — Comprobación de versión de Apinizer SSTI / RCE Infraestructura Plantilla de Nuclei para detectar versiones de Apinizer inferiores a 2026.04.6, que son vulnerables a CVE-2026-11561 Server-Side Template Injection que conduce a la ejecución remota de código, CVSS 9.8. Uso echo |...

CVE-2022-41853

Investigación sobre CVE-2022-41853: Uso de funciones estáticas para obtener RCE mediante deserialización de Java y ataque de código base remoto Quienes utilicen java.sql.Statement o java.sql.PreparedStatement en hsqldb HyperSQL DataBase para procesar entradas no confiables pueden ser vulnerables ...

pdf.js-CVE-2024-4367

🚨 CVE-2024-4367 - Escáner Universal de Vulnerabilidad PDF.js ⚠️ HERRAMIENTA DE SEGURIDAD CRÍTICA | Detecta CVE-2024-4367 CVSS 9.8 - Vulnerabilidad de Ejecución Remota de Código en PDF.js Funciona en CUALQUIER sitio web - Sin configuración requerida 📋 Tabla de Contenidos 📖 Resumen ⚡ Inicio Rápido 🔍...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...

CVE-2023-33781

CVE-2023-33781 Description D-Link DIR-842V2 v1.0.3 was discovered to allow a user to run an arbitrary binary when connecting to telnet. This vulnerability can be triggered using backup/restore functionality. Proof of concept...

CVE-2023-46974

CVE-2023-46974 POC Descripción Vulnerabilidad de Cross-Site Scripting en Best Courier Management System v.1.000 permite a un atacante remoto ejecutar código arbitrario a través de un payload manipulado en el parámetro page de la URL. Tipo de Vulnerabilidad Cross-Site Scripting XSS Proveedor del...

next.js-scanner

next.js-scanner Escáner que detecta CVE-2025-55182 vulnerabilidad de ejecución remota de código en React Server Components...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

XiongMai uc-httpd 1.0.0 - Buffer Overflow

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. id: CVE-2018-10088 info: name: XiongMai uc-httpd 1.0.0 - Buffer Overflow author: 0xAkoko severity: critical description: | Buffer overflow in XiongMai uc-httpd 1.0....

WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE

The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...

Aviatrix Controller - Remote Code Execution

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloudtype for...

Pterodactyl Panel - Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. id: CVE-2025-49132 info: name: Pterodactyl Panel - Remote Code Execution...

Strapi Versions <=4.5.5 - SSTI to Remote Code Execution

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...

Ncast busiFacade - Remote Command Execution

The Ncast Yingshi high-definition intelligent recording and playback system is a newly developed audio and video recording and playback system. The system has RCE vulnerabilities in versions 2017 and earlier. id: CVE-2024-0305 info: name: Ncast busiFacade - Remote Command Execution author: BMCel...

Wavlink WN535K2/WN535K3 - OS Command Injection

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade via manipulation of the argument key. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised...

Roxy-WI - Remote Code Execution

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands. id: CVE-2022-31161 info: name: Roxy-WI - Remote Code...

Cisco IOS XE Web UI - Command Injection

A vulnerability in the web UI component of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to improper input validation in the web UI. An attacker could exploit...