CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

EUVD-2026-91648

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM versions prior to v0.2.20260929-102736 , the software allows control characters to be embedded in Git subtree URLs . An attacker can exploit this by providing a maliciously constructed repository; if a target clones this repository, it can trigger code execution during otherwise re...

pcre2: pcre2: Out-of-bounds write via crafted regular expression

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...

CVE-2026-94422 xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

CVE-2026-94422

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

EUVD-2026-91646

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

CVE-2026-94422

The xdg-dbus-proxy filtering proxy (versions before 0.1.9 ) contains an incorrect implementation of message filtering. An attacker can bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. This vulnerability could allow a malicious ...

CVE-2026-35194

CVE-2026-35194 — Inyección de código SQL en Apache Flink Ejecución remota de código en los TaskManagers de Apache Flink mediante inyección en la generación de código SQL. | ---|--- CVE| CVE-2026-35194 CVSS| 8.1 Alta CWE| CWE-94 — Inyección de código Afectados| Flink 1.15.0 – 1.20.3 / 2.0.0 – 2.2....

Exploit for Command Injection in Php

Task 04 — Exploitation with Metasploit Zyroo Cybersecurity...

CVE-2026-35031

CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...

CVE-2026-34197-Apache-ActiveMQ-RCE

Corregido el problema de fallo del reverse shell causado por no realizar el escape XML del comando...

CVE-2025-69985

FUXA ≤ 1.2.8 认证绕过 + 远程代码执行 CVE-2025-69985 📜 描述 此Python利用程序针对CVE-2025-69985，即FUXA（基于Web的SCADA/HMI软件）版本≤1.2.8中的一个严重认证绕过漏洞。通过向未受保护的/api/runscript端点发送带有嵌入式Node.js代码的精心构造的JSON负载，它能够以FUXA进程的身份实现远程命令执行，并在响应中同步捕获完整的标准输出/标准错误。 🛠️ 安装 !NOTE 为确保项目依赖的干净隔离环境，建议使用Python的venv模块。 OSX/Linux git clone...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Vulnerabilidad de ejecución remota de código no autenticada en Wing FTP Server = 7.4.3. Un byte NULL inyectado en el parámetro username durante el inicio de sesión provoca que se escriba código Lua en el archivo de sesión. Cuando se accede a /dir.html con la cooki...

Exploiting-a-vulnerability-using-reverse-shell

信息安全基础 — 2026年春季项目 总分：20分 | 截止日期：不接受迟交 概述 本项目模拟了跨两台虚拟机的真实攻击与防御场景。你将利用 Erlang/OTP SSH 服务器中的一个关键预认证 RCE 漏洞（CVE-2025-32433），破解提取的密码哈希，然后通过防火墙规则和补丁加固受害者机器。 角色| 操作系统 ---|--- 攻击者| Kali Linux 受害者| Ubuntu/Debian Erlang/OTP SSH v27.3.2 文件 文件| 描述 ---|--- Debian-1.ova| 预构建的受害者虚拟机镜像 — 需单独下载，参见资源 （因过大无法放在...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion 2018 RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2018. Descripción del Exploit El exploit envía una solicitud POST que contiene una reverse shell JSP a...

CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

POC-CVE-2017-8464-OpenCalculator

CVE-2017-8464 / research + PoC Create 1 Shortcut + 1 .DLL containing malicious payload = Put it on a USB and send to victim = victim opens USB = Payload automatically triggers ! ROOT CAUSE 1. First, we need to know exactly where this bug comes from! It's because of a feature called Plug-and-Play ...

poc-CVE-2026-64638-

XSS2Shell — PoC del CVE-2026-64638 Cadena de explotación de XSS pre-autenticación → RCE en WordPress, basada en la investigación de pwn.ai publicada en ionsec.io. ⚠️ AVISO LEGAL : Solo para FINES EDUCATIVOS y PRUEBAS AUTORIZADAS. Úselo únicamente contra sistemas que le pertenezcan o para los que...