CVE-2025-32432

🔐 CVE-2025-32432 — Craft CMS Pre-Auth RCE Pre-Authentication Remote Code Execution in Craft CMS Discovered & Developed by Mohammed Idrees Banyamer 📌 Overview CVE-2025-32432 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting multiple versions of Craft CMS. By chaini...

CVE-2026-90975

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control IOCTL interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mo...

CVE-2023-41892

CVE-2023-41892 A Craft CMS vulnerability that allows Remote Code Execution RCE...

CVE-2019-8331

Eng Description CVE-2019-8331 is a Cross-Site Scripting XSS security vulnerability found in Bootstrap, a JavaScript library widely used for developing websites and mobile applications. This vulnerability occurs because Bootstrap does not properly sanitize data sent via thedata-template attribute ...

CVE-2024-27956-RCE-File-Package

CVE-2024-27956-RCE File Package Contents: 1. exploit.py Original Creator:https://GitHub.com/diego-tella 2. modifiedexploit.py Modified with an ignore ssl verification option 3. Screenshot 4. wpValvePressplugin.py Python script using URI parameters to search for vulnerable wp plugin...

CVE-2024-39069

ifood Order Manager 'Gestor de Peddios.exe' - DLL hijacking An attacker places a malicious DLL named "d3d12.dll" in a directory that is searched by the application before the legitimate "d3d12.dll" is found. When the application is launched, it loads the malicious DLL instead of the legitimate on...

CVE-2023-21971_Analysis

CVE-2023-21971 Connector/J RCE Analysis References Remote Code Execution RCE in com.mysql:mysql-connector-j | CVE-2023-21971 | Snyk New Vulnerability in MySQL JDBC Driver: RCE and Unauthorized DB Access MYSQL JDBC Deserialization Analysis - 跳跳糖 tttang.com Vulnerability Overview Vulnerability in...

CVE-2026-115731

Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

Deep-Reaver

Deep Reaver Deep Reaver is a powerful, AI-enhanced vulnerability assessment and exploitation toolkit built in Python. Inspired by tools like Nmap and Nessus, Deep Reaver is designed for deep, modular scanning of web applications and services. Features AI-assisted analysis via aiassistant.py Modul...

CVE-2026-6009

⚠️ Disclaimer: This repository is for educational purposes and authorized security testing only. Do not use against systems you do not own or have explicit written permission to test. CVE-2026-6009 Proof of Concept Summary The Jaspersoft report library version = 7.0.3 is vulnerable to a remote cod...

CVE-2026-90975 CVE-2026-90975

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control IOCTL interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mo...

EUVD-2026-118416

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control IOCTL interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mo...

CVE-2026-90975

A vulnerability exists in Realtek's RtUsbA64.sys USB audio driver, where a local, low-privileged user can abuse a kernel I/O control (IOCTL) interface . The root cause is the lack of proper validation or capture of a caller-supplied user-mode pointer. By issuing crafted property requests, an atta...

CVE-2026-108262

The open-source local web development tool DDEV (versions 1.25.2 through 1.25.4) contains a vulnerability in the Untar function located in pkg/archive/archive.go. The root cause is that while the system validates absolute tar symlink targets after rebasing them, it creates the symlink using the r...

CVE-2026-108262 DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885

DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted...

EUVD-2026-118403

DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted...

CVE-2019-16447

Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. Successful exploitation could lead to local code execution...

CVE-2019-16447

Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. Successful exploitation could lead to local code execution...

CVE-2026-38751

CVE-2026-38751 — OpenSTAManager Module Upload RCE Authenticated RCE via unvalidated ZIP upload in the module update endpoint. Affected: OpenSTAManager = 2.10.x Requirements pip install requests Usage Reverse shell Penelope or any listener python3 exploit.py -u http://TARGET -U admin -P admin...