CVE-2025-57819-exploit

CVE-2025-57819 — FreePBX प्री-ऑथ SQLi से RCE CVE-2025-57819 के लिए एक ऑल-इन-वन एक्सप्लॉइट, FreePBX के एंडपॉइंट मॉड्यूल में एक अप्रमाणित SQL इंजेक्शन जो क्रॉन जॉब इंजेक्शन के माध्यम से दूरस्थ कोड निष्पादन की ओर ले जाता है। CVSS : 9.8 गंभीर — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA KEV :...

ASUS-AiCloud-RCE

Origasus origasus.go के साथ संकलित, एक Go प्रोग्राम है जो ASUS AiCloud / AsusWRT से संबंधित एंडपॉइंट्स का अधिकृत सुरक्षा परीक्षण या रक्षात्मक विश्लेषण जैसे आपका अपना डिवाइस, सॉफ्टवेयर पेंटेस्ट लैब के दायरे में परीक्षण करने के लिए लिखा गया है। महत्वपूर्ण: इस प्रकार के सॉफ़्टवेयर का अनधिकृत सिस्टम ...

CVE-2026-23918-poc

CVE-2026-23918 — Apache modhttp2 डबल फ्री प्रभावित: Apache HTTP Server 2.4.66 with modhttp2 + Event MPM में ठीक किया गया: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 HIGH — अनधिकृत रिमोट कोड निष्पादन संभव CWE: CWE-415 Double Free क्या है कमजोरी modhttp2 in Apache 2.4.66 के अंदर...

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: رفع ملفات غير مصادَق عليه يؤدي إلى RCE في ملحق DnD Upload CF7 CVE-2026-5718 — ماسح RCE لرفع الملفات في DnD CF7 الملحق: Drag and Drop Multiple File Upload for Contact Form 7 Slug الملحق: drag-and-drop-multiple-file-upload-contact-form-7 معرف CVE: CVE-2026-5718 درجة CVS...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - رفع ملف تعسفي بدون مصادقة الوصف : User Registration Advanced Fields = 1.6.20 - رفع ملف تعسفي بدون مصادقة الوصف إن إضافة User Registration Advanced Fields لووردبريس الإصدارات حتى 1.6.20 معرضة لثغرة رفع ملفات تعسفي بدون مصادقة عبر إجراء AJA...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update अनधिकृत पहुंच भेद्यता Broken Access Control LiteLLM का /config/update एंडपॉइंट कॉल करने वाले की भूमिका अनुमतियों की जाँच नहीं करता । कोई भी प्रमाणित उपयोगकर्ता जिसके पास वैध API Key है बिना व्यवस्थापक अनुमतियों के प्रॉक्सी कॉन्फ़िगरेशन को संशोधित कर सकता है...

react2shell-exploit

CVE-2025-55182 – React2Shell تنفيذ الأوامر عن بُعد في Next.js ⚠️ إخلاء مسؤولية : هذه الوثائق مقدمة لأغراض تعليمية وبحوث أمنية فقط. أي استخدام غير مصرح به لهذه التقنيات ضد أنظمة لا تملكها أو ليس لديك إذن صريح لاختبارها غير قانوني. 📋 جدول المحتويات 1. نظرة عامة 2. كيف يعمل 3. التثبيت والإعداد 4...

Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass

Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter that runs on all pages served by WordPress. The saveGoogleCode function in smartgooglecode.php does not check if the...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

Microsoft SQL Server Reporting Services - Remote Code Execution

Microsoft SQL Server Reporting Services is vulnerable to a remote code execution vulnerability because it incorrectly handles page requests. id: CVE-2020-0618 info: name: Microsoft SQL Server Reporting Services - Remote Code Execution author: joeldeleep severity: high description: Microsoft SQL...

Apache OFBiz 17.12.03 - Cross-Site Scripting

Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request. id: CVE-2020-9496 info: name: Apache OFBiz 17.12.03 - Cross-Site Scripting author: dwisiswant0 severity: medium description: Apache OFBiz 17.12.03 contains cross-site scripting a...

WP Time Capsule Plugin - Remote Code Execution

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...

Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...

Juniper J-Web - Remote Code Execution

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands id: CVE-2023-36845 info: name: Juniper J-Web - Remote Code...

Adobe Commerce (Magento) - Remote Code Execution

Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution. id: CVE-2022-24086 info: name:...

Apache Struts2 S2-062 - Remote Code Execution

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...

Sophos UTM Preauth - Remote Code Execution

Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. id: CVE-2020-25223 info: name: Sophos UTM Preauth - Remote Code Execution author: gy741 severity: critical description: Sophos SG UTMA WebAdmin is susceptibl...

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution. id: CVE-2022-28219 info: name: Zoho ManageEngine ADAudit Plus 7600 - XML Entity Injection/Remote Code Execution author: dwisiswant0 severity:...

Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of GetFileWithoutZip method. The issue results from th...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...