CVE-2026-100682

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100641

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...

CVE-2026-100639

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

CVE-2026-100630

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...

CVE-2026-100613

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

CVE-2026-100695

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...

UBUNTU-CVE-2026-100695

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...

CVE-2022-24086

CVE-2022-24086 CVE-2022-24086 POC example provided by BurpRoot CVE-2022-24086: Overview Affected Software: Magento2 CVE ID: CVE-2022-24086 CVSS Score: 9.8 Critical Description CVE-2022-24086 is a critical security vulnerability affecting multiple versions of the Magento2 e-commerce platform. This...

eval-stdin

Util PHP eval-stdin.php CVE-2017-9841 vulnerabilidad es una vulnerabilidad RCE en eval-stdin.php desactualizado. Este exploit es solo una automatización para la vulnerabilidad mencionada y aún está en desarrollo. Escrito en Ruby 3.0.4 en 2 horas, probado en Kali linux, Arch Linux, Ubuntu minimal ...

redis-stack-CVE-2024-55656

CVE-2024-55656 - Redis Stack - Vulnerabilidad de desbordamiento de enteros en RedisBloom que permite ejecución remota de código Título: Vulnerabilidad de desbordamiento de enteros en RedisBloom de Redis Stack que permite ejecución remota de código ZDI: ZDI-25-009 CVE: CVE-2024-55656 Créditos:...

CVE-2016-6366

CVE-2016-6366 Public repository for improvements to the EXTRABACON exploit, a remote code execution for Cisco ASA written by the Equation Group NSA and leaked by the Shadow Brokers. There is improved shellcode, a LINA offset finder script, a Metasploit module, and extrabacon-2.0. We are adding...

CVE-2026-94132

The AcyMailing Enterprise extension for Joomla (versions 1.0.0 – 11.0.5 ) contains a Remote Code Execution (RCE) vulnerability. The root cause is that the mailbox actions in POP3 mode save incoming MIME attachments to the media/com_acym/upload/ directory without performing extension checks. This ...

CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

EUVD-2026-87772

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

l4j-tp1

log4shell verdadero positivo Este es un proyecto web simple con una vulnerabilidad log4shell. El proyecto define un servicio get scabench.HelloWorldService que devuelve una cadena de texto plano hello world. El servicio no espera parámetros, y si se encuentran parámetros, se registra un error. La...

POC-CVE-2025-68613

Descripción Código de exploit PoC para la vulnerabilidad RCE autenticada en N8N CVE-2025-68613 Uso python3 poc.py -u -c...

BIG-IP-F5-TMUI-RCE-Vulnerability

BIG-IP-F5-TMUI-RCE-Vulnerability CVE-2020-5902 Vulnerabilidad de ejecución remota de código RCE en TMUI de BIG-IP F5: PoC/script de prueba...

CVE-2021-41773

CVE-2021-41773 Un sencillo script POC en bash para la vulnerabilidad de Path Traversal y RCE en Apache 2.4.49 Ejemplo de uso: Configura un listener de netcat: $ nc -nvlp Luego ejecuta el script: $ ./exploit.sh Descargo de responsabilidad Esta herramienta es solo con fines educativos. No me hago...

POC-CVE-2012-1831

POC-CVE-2012-1831 Prueba de Concepto para el CVE-2012-1831 Kingview Touchview 6.53 Antecedentes sobre Kingview KingView® es un potente software SCADA industrial basado en Windows para monitorear y controlar procesos industriales. Con más de 25 años de desarrollo, ahora es conocido por ser el...