weblogic_honeypot

Honeypot de WebLogic Investigación de Cymmetria, 2018. https://www.cymmetria.com/ Escrito por: Omer Cohen @omercnet Agradecimientos especiales: Imri Goldberg @lorgandon, Itamar Sher, Nadav Lev Contacto: [email protected] WebLogic Honeypot es un honeypot de baja interacción para detectar...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept POC by CRFSlick, discovered by AkkuS An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal...

CVE-2024-41817-poc

ImageMagick Ejecución Arbitraria de Código CVE-2024-41817 Exploit de Prueba de Concepto para versiones de ImageMagick = 9.4.0 Paquetes de Python: paramiko Instalación git clone https://github.com/Dxsk/CVE-2024-41817-poc/ cd CVE-2024-41817-poc pip install -r requirements.txt Uso Detección automáti...

Moniker-Link-CVE-2024-21413

🛡️ Moniker Link CVE-2024-21413 Sala: Moniker Link CVE-2024-21413 — TryHackMe Estado: ✅ Completado Fecha: 30 de mayo de 2025 🎯 Objetivo Entender y explotar CVE-2024-21413, una vulnerabilidad en Microsoft Outlook que evita la Vista Protegida usando Moniker Links para filtrar credenciales NTLM...

CVE-2014-6271-Apache-Debian

CVE-2014-6271-Apache-Debian Resumen Este repositorio es un entorno PoC de CVE-2014-6271. Puede desplegar un servicio web que incluye la vulnerabilidad utilizando la imagen de contenedor apache2. Preparación Construcción de la imagen Construya la imagen insegura desde el Dockerfile. docker build -...

CVE-2026-5027

Esta publicación es un artículo de investigación publicado por EQSTLab. Gracias aYahia Hamza, quien reportó y analizó esta vulnerabilidad. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Escritura Arbitraria de Archivos PoC ★ Descripción CVE-2026-5027: Vulnerabilidad de Escritura Arbitrar...

PT-2026-104544

Name of the Vulnerable Software and Affected Versions VikAppointments Services Booking Calendar versions prior to 1.2.22 Description Insufficient file path validation in the extract function allows unauthenticated attackers to delete arbitrary files on the server. This issue can lead to remote co...

Linux Distros Unpatched Vulnerability : CVE-2026-103622

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-103630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-47573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to...

CVE-2026-87115: Improper Limitation of a Pathname to a Restricted Directory

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...

PT-2026-104592

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login as permissions to take over accounts an...

PT-2026-104576

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/' using an unverified session...

PT-2026-104589

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

PT-2026-104475

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.19.0 Description The software fails to block recipe files in the converters/calibre.ts component, passing them directly to the Calibre ebook-convert program. This allows the execution of arbitrary code contained...

PT-2026-104523

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description Insufficient sanitization of file paths within uploaded archives allows authenticated users with access to the asset-management feature to write arbitrary...

CVE-2026-105115: Missing Authentication for Critical Function

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

Debian dla-4816 : libpcre2-16-0 - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4816 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4816-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-103631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...