apache-cve-2021-42013-lab

Apache HTTP Server 2.4.49 Path Traversal & Remote Code Execution CVE-2021-42013 About the Project In this project, I demonstrated the CVE-2021-42013 vulnerability in Apache HTTP Server version 2.4.49 in a lab environment I created using Docker. The goal is to examine how the vulnerability occurs,...

CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...

EUVD-2026-107571

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...

CVE-2026-29001

TastyIgniter versions up to and including 4.4.5 are vulnerable to a PHP object injection vulnerability. The root cause is the unsanitized storage and subsequent unserialization of settings values via the getValueAttribute() function. Authenticated administrators can exploit this by submitting a s...

CVE-2024-5082

Overview This repository contains a Python proof of concept for CVE-2024-5082 , a remote code execution vulnerability in Sonatype Nexus Repository Manager 2. The vulnerability allows a user with sufficient permission to publish a specially crafted Maven artifact and mark it for processing by the...

python-log4rce

Python Log4RCE An all-in-one pure Python3 PoC for CVE-2021-44228. Sample python3 log4rce.py --target "linux" --payload "PAYLOAD" http -X POST --url "http://localhost:8080/" --data "address=" INFO:HTTP:Running on local port 1337 INFO:HTTP:Remote target is http://127.0.0.1:1337/LinuxExploit.class...

php2shell-check

php2shell — Verificação das CVE-2026-109618 e CVE-2026-109619...

CVE-2026-96778

The Pillow Python imaging library (versions 9.4.0 through 13.0.0 ) contains a heap buffer overflow in src/libImaging/JpegEncode.c. The ImagingJpegEncode() function can call jpeg_write_marker() for a JPEG COM comment when an ICC profile exactly fills the 65536-byte encoder buffer. Due to libjpeg w...

EUVD-2026-107566

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

revsync

revsync Realtime sync plugin for IDA Pro, Binary Ninja and Vivisect Syncs: Comments Symbol names Stack var names Structs Code coverage how much time was spent looking at a block IDA Pro Installation First, clone to IDA Data Dir: Windows: %APPDATA%\Hex-Rays\IDA Pro Mac/Linux: /.idapro Now: Make a...

CVE-2026-41179

CVE-2026-47668 Test environment for rclone RCE REF1: https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q REF2: https://github.com/pssec-io/CVE-2026-41179 rce.py RCE on /operations/fdinfo, redirects output to stderr for convenience ./rce.py uname -a exit status 1 Return code: ...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF Arbitrary File Write to RCE PoC Derivation Process and Reflection Scope: This content is intended solely for local test environments, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use...

CVE-2026-114135

A flaw was found in jupyter-server. When configured with a gateway connection, the server validates user authentication but fails to verify whether the user has permission to run actions on computational kernels. A remote authenticated user with restricted privileges can exploit this flaw to open...

CVE-2026-113343

A flaw was found in chromium-browser. A memory corruption vulnerability exists within the browser sandbox, an isolated security environment designed to contain untrusted processes. A remote attacker could exploit this flaw by enticing a user to load a crafted HTML page, leading to arbitrary code...

CVE-2026-113342

A flaw was found in chromium-browser. A remote attacker can exploit a memory corruption issue in the Network component by tricking a user into visiting a crafted HTML page. Successful exploitation allows the attacker to bypass the security sandbox an isolated execution environment and execute...

CVE-2026-113337

A flaw was found in the Scroll component of Chromium. This vulnerability allows a remote attacker to execute arbitrary code within the browser's isolated sandbox environment by convincing a user to visit a specially crafted HTML page. The issue stems from a memory corruption error during scroll...

CVE-2026-113336

A flaw was found in the Compositing component of Chromium. A remote attacker could execute arbitrary code outside the browser's sandbox environment by tricking a user into visiting a specially crafted HTML page. This issue stems from a memory corruption vulnerability during page compositing...

CVE-2026-113331

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to potentially execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page. The issue stems from memory corruption within the browser's Controls component...

CVE-2026-113335

A flaw was found in the Extensions component of chromium-browser. This memory corruption issue allows a remote attacker to execute arbitrary code inside the browser's restricted security environment sandbox. To exploit this vulnerability, an attacker must trick a user into visiting a specially...