CVE-2021-21425-RCE

this is my version i found a lot in internet but those are too bad USAGE root@kitploit: python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 wait.. for 60sec you will get shell at your listener...

CVE-2026-38427

CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in Tasmota fetchjpg CVE: CVE-2026-38427 Severity: Critical CVSS 9.8 Product: Arendst Tasmota Affected Version: = 15.3.0.3 File: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Function: fetchjpg — case 2 MJPEG frame fetch Author: Saidakbarxon...

CVE-2025-32433

CVE-2025-32433 Erlang/OTP SSH RCE EXP Description A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor could gain...

RLSA-2026:67314 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

nginx security update

An update is available for nginx. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other protocols, with a...

RLSA-2026:67280 Important: postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

unrealircd-backdoor-pentest-report

🛡️ UnrealIRCd Backdoor Penetration Test A controlled penetration testing project focused on identifying, exploiting, and remediating the UnrealIRCd 3.2.8.1 backdoor CVE-2010-2075 in an isolated training environment. Disclaimer: This project was conducted strictly for educational and authorized...

CVE-2024-24945-NGINX-RIFT---TryHackMe-Lab-Walkthrough

CVE-2024-24945-NGINX-RIFT---TryHackMe-Lab-Walkthrough This lab demonstrates the exploitation of CVE-2024-24945, a heap corruption vulnerability affecting NGINX. The objective was to understand how memory corruption can lead to Remote Code Execution RCE and gain practical experience in exploitatio...

CVE-2026-6992-PoC

CVE-2026-6992-PoC Vulnerability proof of concept for the bluetooth pin RCE injection CVE-2026-6992 reworked from https://github.com/utmost3/cve/issues/2 I take no credit for discovering the vulnerability. This is for educational and portfolio purposes only. For devices that do not have management...

RLSA-2026:67491 Important: postgresql:16 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

CVE-2026-48939

CVE-2026-48939 — iCagenda Joomla RCE Exploit Pre-Auth Arbitrary File Upload → PHP Code Execution Overview CVE-2026-48939 is a CVSS 10.0 critical vulnerability in the iCagenda events calendar extension for Joomla. The frontend event registration form's file attachment feature enforces access...

CVE-2026-45659

CVE-2026-45659 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized...

CVE-2025-55182-analysis

Technical Analysis of CVE-2025-55182: My Research Journey ⚠️ Important Disclaimer This document describes my personal research process into CVE-2025-55182, including confirmed findings and experiments I carried out. This represents an honest account of my investigation, including initial incorrect...

React2Shell_Rce-cve-2025-55182

React Server Components RCE – README Good day ,I truly hope everything is awesome on your side of the screen! 😊✨ Description React Server Components versions 19.0.0 , 19.1.0 , 19.1.1 , and 19.2.0 , including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, contai...

CVE-2020-14008

CVE-2020-14008 - ManageEngine Applications Manager RCE Authenticated Remote Code Execution via Arbitrary File Upload in Zoho ManageEngine Applications Manager versions = 14720. Vulnerability Summary...

React2Shell-POC

This Proof of Concept PoC for React2Shell CVE-2025-55182 vulnerability has been developed strictly for educational and research purposes only. It is intended to demonstrate the existence and potential impact of a specific security vulnerability in a controlled, authorized, and non-production...

Security Bulletin: Enterprise Content Managemant System Monitor for August 2026 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

Security Bulletin: Enterprise Content Managemant System Monitor for August 2026 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

CVE-2026-89308

An unauthenticated OS command injection vulnerability in the ping.php endpoint of TrxTimeATTENDANCE (a time-attendance application by Trexom ) allows remote attackers to execute arbitrary commands on the underlying operating system, achieving remote code execution (RCE) . The vulnerability is rat...

CVE-2025-7441

CVE-2025-7441 StoryChief 1.0.42 - Arbitrary File Upload Vulnerability CVE-2025-7441 - Technical summary Affected component: StoryChief WordPress plugin Vulnerability type: Unauthenticated arbitrary file upload Vulnerable endpoint: /wp-json/storychief/webhook Root cause: The plugin accepts a JSON...