papercut-toolkit

PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit A defensive toolkit to check and understand exposure to the chained pre-auth remote code execution vulnerabilities in PaperCut: CVE-2026-81578 — Missing Authentication for Critical Function CWE-306. A remote unauthenticated request can...

CVE-2024-12381

CVE-2024-12381 CVE-2024-12381 is a WebAssembly type canonicalization vulnerability in Chrome's V8 engine where CanonicalEquality::EqualValueType fails to account for nullability in indexed reference types. Combined with a JSPI-based V8 sandbox bypass CVE-2024-12692, this allows remote code...

gxdlmsdirector-cve

Multiple vulnerabilities in Gurux GXDLMS Director – remote code execution Gurux GXDLMS Director is an open-source Windows program for interacting with energy meters through the use of DLMS/COSEM protocol. The software has a remote update functionality for add-in DLLs as well as for files containi...

CVE-2023-36745

CVE-2023-36745 PoC de RCE de Microsoft Exchange Server CVE-2023-36745. Ejemplo: python3 exp.py -H exchange.webdxg.com -u webdxg.com\dddai -p 4IDF7LAU -s \192.168.237.131\Shares\ -c calc.exe El comando se pasará a powershell -e...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-4577

CVE-2024-4577 - PHP-CGI Argument Injection RCE | | ---|---|--- CVE| Description| CVSSv3 CVE-2024-4577| PHP-CGI Argument Injection Vulnerability| 9.8 | | "CVE-2024-4577 is a critical argument injection vulnerability in PHP that can be exploited to achieve remote code execution RCE. According to...

CVE-2025-49113

CVE-2025-49113 Roundcube Exploit A Python exploit for CVE-2025-49113, targeting a vulnerability in Roundcube webmail that allows remote code execution through PHP object deserialization. Overview This exploit leverages a deserialization vulnerability in Roundcube's file upload functionality. It...

Linux Distros Unpatched Vulnerability : CVE-2026-108693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare...

Apache Celix 2.4.0 EDEF XML Parser Heap-Based Buffer Overflow

Summary Apache Celix is an implementation of the OSGi specification adapted to C and C++. It is a framework to develop dynamic modular software applications using component and/or service-oriented programming. Description Apache Celix suffers from a heap-based buffer overflow vulnerability in its...

Apache Celix 2.4.0 EDEF XML Parser Heap Buffer Overflow

Apache Celix version 2.4.0 contains a heap-based buffer overflow in its remote-services Endpoint Description Extender XML parser. The supplied proof of concept generates a crafted endpoint descriptor that triggers the overflow. !/usr/bin/env python Apache Celix 2.4.0 EDEF XML Parser Heap-Based...

PT-2026-110011

Name of the Vulnerable Software and Affected Versions Anton Extensions versions prior to 1.2.3 Description An issue exists where the plugin fails to perform capability checks, nonce verification, and file-type validation before writing content to a chosen path. This allows unauthenticated attacke...

CVE-2012-1723

Web browser drive-by that exploits CVE-2012-1723 for remote code execution. A walk-through and technical details can be found at https://ethaniel.me/2017/02/09/practice-the-past-cve-2012-1723/...

CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution

CVE-2026-3844 – Breeze Cache WordPress Plugin Unauthenticated RCE -red?style=flat-square CVE-2026-3844 is a critical unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin versions ≤ 2.4.4. An attacker can post a comment containing a malicious tag pointing to a P...

CVE-2016-10033

WordPress 4.6 - Remote Code Execution RCE PoC Exploit CVE-2016-10033 It is modified version of Dawid Golunski's exploit 41962...

CVE-2026-11645

CVE-2026-11645 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-06-09 Technical Summary Out...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to RCE Overview CVE-2024-50330 is a critical pre-authentication SQL injection vulnerability in Ivanti Endpoint Manager EPM that allows a remote unauthenticated attacker to achieve remote code execution on the target server. The vulnerabili...

List-CVE-2025-2026

CVE-2025-69412 - KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API aka phishing API, which might allow ... 2. CVE-2025-69413 - In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on...

cve-2025-61882-oracle_ebs_rce_reproduction

CVE-2025-61882 — Oracle E-Business Suite Unauthenticated Remote Code Execution CVSS 9.8 CRITICAL Overview CVE-2025-61882 is an unauthenticated remote code execution vulnerability in Oracle E-Business Suite EBS, affecting the Concurrent Processing and BI Publisher components. The flaw allows an...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept Description pocwptot.py is a proof‑of‑concept PoC to exploit a time‑based blind SQL injection vulnerability on the WordPress REST API batch endpoint, and perform an escalation chain up to Remote Code Execution RCE...

CVE-2025-65855

CVE-2025-65855 HelpFlash IoT OTA Update Multiple Vulnerabilities Summary Multiple vulnerabilities in the OTA firmware update mechanism of Netun Solutions HelpFlash IoT allow an attacker with brief physical access to execute arbitrary code. CVE ID: CVE-2025-65855 Severity: HIGH CVSS v3.1 Score: 7....