CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Aviso de seguridad: Camaleon CMS - RCE autenticado mediante el campo personalizado selecteval ID de CVE asignado: CVE-2026-66748 Producto: Camaleon CMS https://github.com/owen2345/camaleon-cms Versiones afectadas: 2.1.1 – 2.9.1 introducido en el commit 415cbda6 2015-10-16; corregido en el commit...

CVE-2026-8838-RCE

CVE-2026-8838 — Amazon Redshift Python Driver: Remote Code Execution via eval ⚠️ Educational Use Only Proyecto de investigación y demostración en ciberseguridad ofensiva realizado exclusivamente con fines pedagógicos y de sensibilización. Cualquier uso en sistemas sin autorización explícita es...

CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 Remote Code Execution Exploit de inyección de código PHP para Dolibarr ERP/CRM v17.0.0 que permite obtener una shell reversa como usuario www-data mediante el módulo Website/CMS. ⚠️ Solo para uso educativo y auditorías con autorización. 📑 Índice ¿Qué es...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — Escáner de RCE mfunc/eval de W3 Total Cache Plugin: W3 Total Cache Slug del plugin: w3-total-cache ID de CVE: CVE-2026-27384 Puntuación CVSS: 9.8 Crítica Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Tipo de vulnerabilidad: Ejecución arbitraria de códig...

CVE-2022-0847

CVE-2022-0847 Vulnerabilidad en el kernel de Linux desde 5.8 que permite sobrescribir datos en archivos de solo lectura arbitrarios. Esto conduce a una escalada de privilegios porque los procesos no privilegiados pueden inyectar código en procesos root. Para compilar: gcc poc.c -o poc Usage: ./po...

CVE-2024-23346-rust-exploit

Un script de explotación en Rust para CVE-2024-23346. Como se muestra a continuación, el POC utiliza la vulnerabilidad de inyección de código y ejecuta comandos remotos de shell como en una terminal. poc.webm Pasos para ejecutar el exploit: Ejecutar directamente con Cargo cargo run -- --help carg...

CVE-2026-51881

The software deeptutor 1.4.0 is vulnerable to a code injection flaw in the ExecTool.execute component. An attacker can exploit this via the live tutorbot WebSocket interface to force the tool layer to execute arbitrary, reviewer-chosen shell commands within the service environment. Exploitation d...

CVE-2026-51886

The langflow-ai langflow application (up to version v1.9.3 ) is vulnerable to a Code Injection vulnerability in the validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 function within src/backend/base/langflow/api/v1/validate.py:13. A public-facing route accepts raw Python source...

AlmaLinux 9.2 [TuxCare] Security Update: perl-DBI Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786120315)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786120315 advisory. - DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_5869)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235869 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 A Rocky Enterprise Software Foundation Securi...

Rocky Linux 8 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (crlsa-2024_3233)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243233 advisory. libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname CVE-2023-6004 libssh: Missing checks for return values for diges...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782222901)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782222901 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch...

MongoDB Compass 1.44.0 < 1.49.12 Code Injection

The version of MongoDB Compass installed on the remote host is 1.44.0 prior to 1.49.12. It is, therefore, affected by a vulnerability: - MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that...

CentOS Linux 6 [TuxCare] Security Update: spamassassin Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777548877)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777548877 advisory. - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certai...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2021_2588)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212588 advisory. rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code CVE-2019-3881 ruby: NUL injection vulnerability of...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_6818)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236818 advisory. golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-44487 CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are...

Rocky Linux 9 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (crlsa-2024_2504)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242504 advisory. libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname CVE-2023-6004 libssh: Missing checks for return values for diges...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_7205)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237205 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 nodejs: permission model improperly protects...

Rocky Linux 10.2 [CIQ] Security Update: qt6-qtdeclarative / qt6-qtdeclarative-debuginfo / etc (crlsa-2026_20567)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202620567 advisory. qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file CVE-2025-14576 Tenable has extracted the preceding description block directly from th...

Rocky Linux 10.2 [CIQ] Security Update: gpsd / gpsd-clients / gpsd-clients-debuginfo / gpsd-debuginfo / etc (crlsa-2026_65162)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202665162 advisory. gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility CVE-2026-60122 Tenable has extracted the preceding description block directly...