CVE-2026-64638

CVE-2026-64638 — XSS2Shell: XSS pre-autenticazione nella pagina di login di WordPress → RCE sul server Mirror di distribuzione HackSpeak. Questo repository è un mirror distributivo del PoC didattico XSS2Shell CVE-2026-64638 pubblicato da WordSec , con codice identico all'upstream; l'upstream è MI...

isf

Industrial Exploitation Framework ISFIndustrial Exploitation Framework is a exploitation framework based on Python, it's similar to metasploit framework. ISF is based on open source project routersploit. Read this in other languages:English, 简体中文, Disclaimer Usage of ISF for attacking targets...

Nuclei-Template-Exploit-F5-BIG-IP-iControl-REST-Auth-Bypass-RCE-Command-Parameter

Nuclei Template Exploit F5 BIG-IP iControl REST Auth Bypass RCE | Parametro Comando CVE-2022-1388 è una vulnerabilità di bypass dell'autenticazione nel componente REST dell'API iControl di BIG-IP a cui è stato assegnato un punteggio CVSSv3 di 9.8. L'API REST iControl è utilizzata per la gestione ...

CVE-2021-25646-exp

CVE-2021-25646-exp Apache Druid CVE-2021-25646 strumento di rilevamento e sfruttamento della vulnerabilità di esecuzione remota di codice Inserisci dominio o IP:porta per eseguire la scansione della vulnerabilità Per i target vulnerabili, è possibile sfruttare l'esecuzione di comandi Supporta...

CVE-2022-31491

CVE-2022-31491 Metasploit-Modul und PoC-Dateien in diesem Repository. Weitere Informationen Voltronic Viewpower/Pro und Rebrands/Abwandlungen Die UPS-Verwaltungssoftware ermöglicht es einem ordnungsgemäß authentifizierten und autorisierten Benutzer normalerweise, über eine Weboberfläche das Syste...

rocketcat-cve-2021-22911-exploit

Rocket.Chat CVE-2021-22911 एक्सप्लॉइट ⚠️ अस्वीकरण - केवल शैक्षणिक उपयोग यह एक्सप्लॉइट केवल अधिकृत पैठ परीक्षण penetration testing और शैक्षणिक उद्देश्यों के लिए है। कंप्यूटर सिस्टम तक अनधिकृत पहुंच अवैध है। लेखक किसी भी दुरुपयोग के लिए जिम्मेदार नहीं है। 📋 अवलोकन CVE-2021-22911 Rocket.Chat में एक...

CVE-2022-46649

CVE-2022-46649 PoC-Exploit für CVE-2022-46649, eine Befehlsinjektions-Schwachstelle im Endpunkt /cgi-bin/iplogging.cgi. Die Schwachstelle ermöglicht authentifizierten Angreifern die Ausführung beliebiger Betriebssystembefehle über manipulierte tcpdumpParams. Übersicht Schwachstelle: OS Command...

CVE-2026-76797

The MongoSQL Transition Readiness Tool (MongoDB) is vulnerable to CSV injection through its generated reports. Database and collection names are written into CSV output without neutralizing leading characters that spreadsheet applications interpret as formulas. An attacker with write privileges o...

cve-2022-28944

CVE-2022-28944 Vulnerabilidade de Execução Remota de Código sem Autenticação em Atualização de Múltiplos Produtos do EMCO Software. Uso: python3 cve-2022-28944poc.py Detalhes no relatório em gerr.re. Passos para reproduzir 1. Instale um produto afetado do EMCO Software; 2. Defina o spoof...

GHSA-9X44-4GXF-8C25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Upload Irrestrito de Arquivo → RCE Vulnerabilidade Crítica de Upload Irrestrito de Arquivo no Elementor Pro Potencialmente levando à Execução Remota de Código RCE ⚠️ Visão Geral CVE-2026-32475 é uma vulnerabilidade de segurança crítica que afeta o Elementor Pro , u...

EUVD-2026-67871

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

CVE-2026-55634

Pimcore, an open-source Data & Experience Management Platform, is vulnerable to Remote Code Execution via its class-definition import endpoint. Prior to versions 11.5.19, 12.3.10, and 2026.1.6, a DataObject field name is emitted without an identifier allowlist into generated PHP properties (Field...

CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow OSS Esecuzione Remota di Codice Non Autenticata RCE Vulnerabilità critica di esecuzione remota di codice non autenticata che interessa IBM Langflow OSS. La vulnerabilità deriva dalla combinazione di due debolezze: 1. /api/v1/autologin può rilasciare un bearer token...

CVE-2026-28134

Relatório de Exploração CVE-2026-28134 JetEngine = 3.7.2 — Execução Remota de Código Autenticada Contribuidor+ via SSTI em Twig Data: 11 de março de 2026 Pontuação CVSS: 8.8 Alta Vetor CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Plugin Afetado: JetEngine = 3.7.2 Slug do Plugin: jet-engine...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms: Nicht authentifizierter beliebiger Datei-Upload → RCE CVSS 9.8 Kritisch · Betroffen: Forminator = 1.56.1 · Behoben: 1.56.2 Forscher: daroo Wordfence Bug Bounty, $2.048 · 600.000 aktive Installationen Write-up:...

GHSA-W23P-WRP7-CH38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

CVE-2026-55220

Pimcore (Open Source Data & Experience Management Platform) contains an unrestricted deserialization flaw in Hotspotimage::getDataFromResource() . After JSON decoding of the __hotspots object-store column fails, the raw value is passed to Serialize::unserialize() without an allowed-classes whitel...