1279227 matches found
CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE
make it a readme.md to paste into it CVE-2025-69906: Monstra CMS 3.0.4 Arbitrary File Upload to RCE Author : David PS Abraham Date : February 5, 2026 Severity : Critical - Remote Code Execution CVSS 8.8+ CWE : 434 Unrestricted Upload of File with Dangerous Type Vulnerability Description Monstra C...
CVE-2026-82166
Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution...
CVE-2026-71170
Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution...
CVE-2026-112777
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObje...
CVE-2026-112772
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious...
CVE-2026-112773
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...
CVE-2026-112770
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...
CVE-2026-112774
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...
CVE-2023-33246
CVE-2023-33246 Apache RocketMQ Remote Code Execution CVE-2023-33246 Exploit Usage: java -jar CVE-2023-33246.jar -ip "127.0.0.1" -cmd "open -a calculator" Disclaimer: This detection tool is intended only for security testing by security testers of major security companies. Do not use it to invade ...
CVE-2024-30973
CVE-2024-30973 - V-SOL G/EPON ONU - HG323AC-B Description Item: Item: G/EPON ONU Specification: HG323AC-B Device model XPON+2GE+1POTS+2WIFI+USB Device SN 70B64F-1234570B64F0C2C0C Hardware Version V1.0 Firmware Version V2.0.08-210715 PON S/N GPON000C2C0C Vulnerability Type: Incorrect...
CVE-2021-42392-exploit-lab
⚠️ H2 Database RCE Exploit PoC CVE-2021-42392 This repository provides a minimal and controlled environment to test the H2 Database Remote Code Execution vulnerability CVE-2021-42392 using the CREATE ALIAS feature. Unlike many demonstrations, this exploit targets the H2 TCP service directly...
c0ntextomy
c0ntextomy an informal fallacy and a type of false attribution in which a passage is removed from its surrounding matter in such a way as to distort its intended meaning Wikipedia - Contextomy A Proof of Concept demonstrating the vulnerability with a debug session hijack, remote code execution, a...
CVE-2020-23591
CVE-2020-23591 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" which allows an attacker to upload arbitrary file through "...
CVE-2023-38646
CVE-2023-38646 - Metabase Pre-Auth RCE ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author securezeron Step Guides 1. Set Up the Listener on your attacker machine: nc -nlvp 4444 2. Then, run this command: python3...
CVE-2021-41773
CVE-2021-41773 A simple bash POC script for Path Traversal & RCE vulnerability in Apache 2.4.49 Example usage: Setup a netcat listener: $ nc -nvlp Then run the script: $ ./exploit.sh Disclamer This tool is for educational purposes only. I hold no responsibility for any misuse...
CVE-2024-25293
MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...
CVE-2025-48827
Description: RCE for Vbullettin versions between 5.0.0 - 5.7.5 and 6.0.0 - 6.0.3 with PHP 8.1 Futures: Multi thread Read from multiple target from file Detect vbullettin websites Checks vulnerabilit, if succes upload a php webshell Detail of usage: usage: CVE-2025-48827.py -h --url URL --list LIS...
CVE-2006-3592
CVE-2006-3952 Exploit for Easy File Sharing FTP Server 3.5 on Win7 32 Based on: pwntools msfvenom / reversetcp payload Vulnerable app available at https://www.exploit-db.com/apps/0efddb6d04f4125d7c1f104c6b1c60a0-efsfs.exe Simple SEH overrite + couple jumps back, due to stack being corrupted after...
CVE-2020-14882-WebLogic-Analysis
Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...