Google ADK-Python - Unauthenticated Builder Endpoint

Google Agent Development Kit ADK 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python OSS, Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication...

Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...

MediaWiki EasyTimeline - Code Injection RCE

MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...

N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution

N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection CWE-96. An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every...

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

CVE-2022-42045

CVE-2022-42045 Resumen Descubrimos una inyección de código arbitraria en el controlador de modo kernel amsdk.sys de Zemana, parte del SDK Antimalware de Zemana. La vulnerabilidad permite inyectar un código arbitrario en una de las secciones de código del controlador y luego ejecutarlo con...

Spring-Cloud-Gateway-CVE-2022-22947

Spring-Cloud-Gateway-CVE-2022-22947 Security advisory for the remote code execution vulnerability in Spring Cloud Gateway. This vulnerability occurs when the Gateway Actuator endpoint is enabled and exposed in Spring Cloud Gateway, making applications using Spring Cloud Gateway susceptible to cod...

CVE-2022-0847

CVE-2022-0847 Dirección original https://dirtypipe.cm4all.com/ Uso gcc exploit.cpp -o exploit ./exploit abre una shell de root Descripción de la vulnerabilidad Esto es CVE-2022-0847, una vulnerabilidad en el kernel de Linux desde la versión 5.8 que permite sobrescribir datos en archivos de solo...

CVE-2025-24893

Exploit for CVE-2025-24893 CVE-2025-24893 is a critical unauthenticated remote code execution RCE vulnerability affecting the XWiki Platform. This flaw lets any guest user inject and execute arbitrary Groovy code —without authentication—via a specially crafted RSS request to the SolrSearch...

CVE-2023-49314

CVE-2023-49314 Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and enableNodeCliInspectArguments, and thus electroniz3r can be used to perform an attack. There is a tool...

CVE-2023-46818-python-exploit

CVE-2023-46818 exploit This is a python version of the original php script for the vulnerability affecting ispconfig 3.2.11 and previous versions. Original PHP source: https://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html This proof-of-concept is intended for...

CVE-2024-0507_CVE-2024-0200-github

Introducción Este repositorio contiene exploits que hemos desarrollado para las vulnerabilidades de GitHub Enterprise CVE-2024-0507 y CVE-2024-0200. Consulta el artículo completo en https://blog.convisoappsec.com/en/analysis-of-github-enterprise-vulnerabilities-cve-2024-0507-cve-2024-0200/...

active-scan-plus-plus

ActiveScan++ ActiveScan++ extends Burp Suite's active and passive scanning capabilities. Designed to add minimal network overhead, it identifies application behaviour that may be of interest to advanced testers: Potential host header attacks password reset poisoning, cache poisoning, DNS rebindin...

PT-2026-106721

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

PT-2026-106715

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2025-47812

=========================================================== CVE-2025-47812 - Wing FTP Server Remote Code Execution RCE =========================================================== Author: blindma1den Date: July 2025 Exploit Type: Remote Code Execution Unauthenticated Target: Wing FTP Server 7.4.4...

CVE-2023-46818

CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash CVE-2023-46818 Authenticated PHP Code Injection in ISPConfig for more details: advisory CVE-2023-46818 PoC Introduction ISPConfig versions Note: This exploit requires valid ISPConfig admin credentials and will deploy a command web she...

injectAmsiBypass

Cobalt Strike BOF - Inyectar omisión de AMSI Archivo de Objeto Beacon BOF de Cobalt Strike que omite AMSI en un proceso remoto mediante inyección de código. Ejecutando el BOF inject-amsiBypass desde CobaltStrike ¿Qué hace esto? 1. Usa el argumento PID proporcionado para obtener un identificador...

CVE-2024-0195-SpiderFlow

CVE-2024-0195 Control Inadecuado de la Generación de Código 'Inyección de Código' Resumen CVE-2024-0195 es una vulnerabilidad crítica de inyección de código en la aplicación web spider-flow 0.4.3, específicamente en la función FunctionService.saveFunction del archivo FunctionController.java. Un...