CVE-2026-118423

The WP Libre Form WordPress plugin version 1.5.0.1 is vulnerable to remote code execution (RCE) . The root cause is a failure to validate file types during form submissions, which allows unauthenticated attackers to upload PHP files to a web-accessible directory. Once uploaded, these files can be...

EUVD-2026-117971

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution...

CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution...

FreePBX-CVE-2025-57819-CVE-2025-61678

FreePBX-CVE-2025-57819-CVE-2025-61678 Chains CVE-2025-57819 stacked query SQL injection and CVE-2025-61678 authenticated file upload in FreePBX Endpoint Manager to achieve Remote Code Execution RCE. For educational use only. References:...

WordPress WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by GivMeInJ in WordPress Plugin Save Contact Form 7 data to Google Spreadsheet versions = 1.8.0...

CVE-2026-94395

A flaw was found in SafeNet Authentication Client SAC. A stack-based buffer overflow vulnerability in the SIS token engine allows an attacker connecting a malicious physical or software-emulated smart card to execute arbitrary code with the privileges of the affected process. This flaw occurs...

CVE-2026-58128

A flaw was found in Alan: Health Insurance for Android. This vulnerability allows a local malicious application on the same device to achieve arbitrary code execution or tamper with application data by overwriting sensitive files in the application's private storage. An attacker can exploit this...

Mintinstall-object-injection

TR Linux mint yazılım yöneticisi v 7.9.5/9 yanlış yapılandırmadan dolayı obje enjeksiyonu ve keyfi kod çalıştırmamıza neden olmaktadır. EN Linux mint software manager v 7.9.5/9 causes us to execute object injection and arbitrary code due to incorrect configuration mintinsall TR Mint yazılım...

CVE-2026-122160

A flaw was found in AIlice. The Hugging Face model wrapper fails to properly restrict or validate model paths within the LoadModelPEFT function. A remote attacker could exploit this vulnerability by supplying a manipulated model path, causing the application to load and execute untrusted external...

WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection vulnerability

Authenticated Shop Manager+ PHP Code Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 8.0.26...

CVE-2025-49844

CVE-2025-49844 Original uv POC: https://github.com/saneki/cve-2025-49844 PoC that provides reverse shell. Before Start pip3 install -r requirements.txt Help python3 CVE-2025-49844.py -h usage: CVE-2025-49844.py -h -H HOST -P PORT -a PASSWORD -l HOST -p PORT CVE-2025-49844 proof-of-concept — Redis...

CVE-2026-89960

A flaw was found in the Linux kernel's s390/vfio-ap component. This vulnerability occurs when an error during the setup of a virtual machine KVM leaves a pointer to a cryptographic function in an invalid state. A malicious guest virtual machine could exploit this by executing a specific...

CVE-2026-89774

A flaw was found in the Linux kernel's Bluetooth Synchronous Connection-Oriented SCO module. This Use-After-Free UAF vulnerability occurs due to a race condition where the system attempts to use a memory region after it has been freed. A remote attacker could exploit this flaw by initiating a...

CVE-2026-97209

A flaw was found in Elixir's Mix build tool. During partitioned dependency compilation, Mix exchanges configuration data through a predictable folder in the shared system temporary directory without properly verifying directory ownership. A local attacker on the same host can exploit this flaw by...

php2shell-619-poc

CVE-2026-109619 — PHP Session Upload Progress OOM → RCE Explo...

Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

CVE-2026-118905

A flaw was found in nvm. Improper input sanitization when filtering version strings allows injected commands to be processed by the underlying stream editor sed. A local attacker can exploit this vulnerability by enticing a user to process an untrusted version string—such as through a directory...

CVE-2026-112302

A flaw was found in kiwilan php-archive. The ZIP archive extraction process fails to properly validate destination file paths, leading to a path traversal vulnerability. A remote attacker can provide a specially crafted ZIP archive containing directory traversal sequences to exploit this flaw...

CVE-2026-111059

A flaw was found in Mercury. The application fails to properly sanitize raw HTML when converting user-controlled Markdown into web components. A remote attacker could exploit this vulnerability by providing malicious Markdown containing active HTML elements or scripts, resulting in Cross-Site...