CVE-2019-16278-Nostromo-1.9.6-RCE

CVE-2019-16278-Nostromo-1.9.6-RCE Este es un exploit de CVE-2019-16278 para Nostromo 1.9.6 RCE. Este exploit permite RCE en la máquina víctima. Requisitos optparse socat sys Uso Puedes usar el exploit de la siguiente manera: python3 CVE-2019-16278.py --ip=10.129.192.225 --port=80 --command="bash ...

log4shell-poc

CVE-2021-44228 Log4Shell POC Overview Proof of Concept for Remote Code Execution via JNDI Injection vulnerability in Apache Log4j 2.14.1. Web Hacking Course - Week 11 Assignment. Environment Role| Software| Version ---|---|--- Victim Server| Spring Boot + Log4j| 2.6.1 + 2.14.1 Victim JDK| OpenJDK...

CVE-2025-55182

CVE-2025-55182 React2Shell Exploit Kit 🎯 Complete Working Exploit Demonstration This project provides a fully functional demonstration of CVE-2025-55182 React2Shell - a critical Remote Code Execution vulnerability in React Server Components and Next.js. Status: ✅ WORKING - Achieves actual command...

CVE-2025-55182-React-RSC-Exploit

CVE-2025-55182 // REACT SERVER COMPONENTS RCE VISIÓN GENERAL PoC de exploit para CVE-2025-55182. Apunta a versiones inseguras y vulnerabilidades en funciones de validación de entrada en React Server Components. MECANISMO TÉCNICO Vector : Contaminación de prototipos a través de $1:proto :then...

CVE-2025-6218-WinRAR-RCE-POC

CVE-2025-6218: WinRAR Path Traversal RCE ⚠️ VULNERABILIDAD CRÍTICA - Explotación Activa Confirmada CVE-2025-6218 es una vulnerabilidad crítica de path traversal en WinRAR que permite la ejecución de código arbitrario. Actualmente explotada por grupos APT como GOFFEE, Bitter APT-C-08 y Gamaredon. 📋...

PT-2026-106248

Name of the Vulnerable Software and Affected Versions Docling versions 2.27.0 through 2.130.0 Description Plugin factories in docling/models/factories/base factory.py call the load setuptools entrypoints function before the allow external plugins setting is applied. This sequence allows every...

CVE-2026-105225: Improper Control of Generation of Code

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULEPAYMENTINSTALLED leads to code injection. The attack can be executed remotely...

EUVD-2026-92441

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-105314: Path Traversal: '../filedir'

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-78862

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board PCB...

CVE-2026-105188: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site...

CVE-2026-78861: Undefined Security Weakness

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-105638: Improper Restriction of Excessive Authentication Attempts

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...

CVE-2026-78862

An issue in the Mercusys AC12 V2 hardware allows a local attacker to achieve arbitrary code execution . This vulnerability is triggered via the UART serial interface located on the device's printed circuit board (PCB) . No specific software versions, remediation steps, or exploit links are provid...

PT-2026-106133

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An Expression Language Injection issue exists when the...

CVE-2026-104711: Improper Neutralization of Special Elements used in an Expression Language Statement

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791208722)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791208722 advisory. - Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proce...

RHEL 8 : pki-core:10.6 (RHSA-2026:75573)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:75573 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: Dogtag/PKI:...

Linux Distros Unpatched Vulnerability : CVE-2026-63277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such ...

Cisco ASA Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2019-15992)

A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating...