DOLIBARR-RCE-CVE-2026-22666

This repository does not have a README...

CVE-2026-22692

CVE-2026-22692: Critical Twig Sandbox Bypass via collect-mapInto allowing RCE/LFI/XXE October CMS Overview Field| Details ---|--- CVE ID| CVE-2026-22692 Severity| Moderate CVSS:3.1 4.9 Advisory| GHSA-m5qg-jc75-4jp6 Affected Product| October CMS RCE, LFI, XXE Discovered by| Lukasz Rybak CWE...

Flowise-CVE-2026-58057-exploit

Flowise CVE-2026-58057 - Windows Remote Code Execution Exploit -orange?style=for-the-badg...

document-viewer-link-handler-security-assessment

CVE-2026-46529 - Atril Evince XReader PDF Clickable Link RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for document viewer link-handler risk, including impact analysis, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details ---|--- Report...

apache-mina-deserialization-security-assessment

CVE-2024-52046 - Apache MINA Deserialization RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Apache MINA deserialization risk, including executive summary, technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details ---|---...

CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as an email attachment or othe...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo test please UPGRADE spring data rest NOW. steps 启动本应用 创建test instance POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" 利用spel注入, 会启动C:\Windows\system32\calc.exe PATCH /entityPersons/1...

CVE-2026-25632

CVE-2026-25632 — JSON Deserialization RCE in REST API Bugfix Challenge Inspired by a real 2026 vulnerability CVSS 10.0, actively exploited Based on: CVE-2026-25632 — Remote Code Execution via unsafe type-driven JSON deserialization discovered in the EPyT-Flow water-network simulation REST API and...

CVE-2025-55182-exp

CVE-2025-55182-exp 🔥 Overview CVE-2025-55182 is a critical Remote Code Execution RCE vulnerability in React Server Components RSC affecting Next.js applications using App Router with Server Actions. The vulnerability exists in the Flight protocol deserialization process, allowing attackers to...

CVE-2026-52813-Gogs-RCE

CVE-2026-52813 — Gogs Path Traversal Leading to Git Hooks Remote Code Execution Defensive Analysis Security research / Blue team writeup. This repository does not contain weaponized PoC. Researchers needing reproduction should use the public PoC referenced in the official advisory. Item| Content...

CVE-2026-110936

A vulnerability has been identified in Siemens Software Center All versions. The affected application loads dynamic-link libraries DLLs from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches,...

CVE-2026-110746

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM...

Nest

!Issueshttps://img.shields.io/github/issues/owasp/nest?color=blue&style=...

CVE-2026-103508

P4 Search formerly Helix Search allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search...

CVE-2026-9198_exploit

CVE-2026-9198 — Langflow OSS Unauthenticated RCE Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 – 1.10.0 on a default deployment. Chains two flaws: CVE-2026-9103 — GET /api/v1/autologin mints a SUPERUSER JWT to any caller with no credentials whenever AUTOLOGIN is enabled the...

voron-crypto

Voron crypto/protocol library — request for review This is the crypto and messaging-protocol core of a small E2EE messenger project, pulled out on its own for outside review. It is not the whole product — the Android client and deployment config are intentionally left out; this is just the part...

ghostlock-vagrant-box

Full Chain Vulnerability Testbed: Nginx RCE → GhostLock LPE Overview This repository provides a Vagrant environment designed to demonstrate a complete two-stage exploitation chain. The testbed automatically provisions an isolated Ubuntu 22.04 LTS virtual machine that is intentionally configured t...

CVE-2021-3129-Lab

CVE-2021-3129: Laravel Debug Mode RCE Lab Hands-on lab for exploiting CVE-2021-3129 - a critical Laravel vulnerability allowing unauthenticated file read and potential RCE. Quick Start Clone git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git cd CVE-2021-3129-Lab Build & Run dock...

CVE-2020-16898--EXP-POC

CVE-2020-16898 CVE-2020-16898 Windows TCP/IP Remote Code Execution Vulnerability EXP&POC Reproduction forforever: https://www.cnblogs.com/forforever/p/13846077.html POC CVE-2020-16898Checker-poc Command: Run PowerShell/CMD as administrator Powershell.exe -ExecutionPolicy UnRestricted -File...

CVE-2024-10586-Poc

Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...