CVE-2026-54424

CVE-2026-54424 Exploiting Parsec for Windows versions 150-104a to gain: Remote code execution as SYSTEM Arbitrary file read as SYSTEM NTLM hash capture for SYSTEM The exploits stem from the same vulnerability, but the actual paths diverge. Technical writeup:...

CVE-2025-69212

CVE-2025-69212 Description OpenSTAManager is a management software solution for technical assistance, electronic invoicing, and accounting. The versions =2.9.8 are vulnerable to an authenticated remote code execution vulnerability. An attacker can exploit this issue by uploading a specially craft...

vuln-app-CVE-2025-55182

Vulnerable Next.js RSC Application - CVE-2025-55182 ⚠️ WARNING: This application is intentionally vulnerable for educational and security research purposes only. DO NOT deploy to production or expose to the internet. Overview This is a vulnerable Next.js application that demonstrates CVE-2025-5518...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution RCE vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary command...

cve-2025-66398

⚠️ cve-2025-66398 - Simple RCE Proof of Concept Tool ⚙️ About This Tool This project demonstrates a remote code execution RCE vulnerability in Signal K Server versions 2.18.0 and earlier. The proof of concept PoC shows how an attacker could run commands on a vulnerable device. This tool is designed...

CVE-2025-53772-IIS-WebDeploy-RCE

CVE-2025-53772 - IIS WebDeploy RCE Exploit This repository contains a Proof-of-Concept PoC exploit for CVE-2025-53772, a Remote Code Execution vulnerability in IIS WebDeploy through unsafe deserialization. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Th...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...

CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE

make it a readme.md to paste into it CVE-2025-69906: Monstra CMS 3.0.4 Arbitrary File Upload to RCE Author : David PS Abraham Date : February 5, 2026 Severity : Critical - Remote Code Execution CVSS 8.8+ CWE : 434 Unrestricted Upload of File with Dangerous Type Vulnerability Description Monstra C...

MAL-2026-17847 Malicious code in npp-ml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. --- Category: MALICIOUS - The...

CVE-2026-96012

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated...

CVE-2026-109422

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2020-23591

CVE-2020-23591 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" which allows an attacker to upload arbitrary file through "...

CVE-2023-38646

CVE-2023-38646 - Metabase Pre-Auth RCE ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author securezeron Step Guides 1. Set Up the Listener on your attacker machine: nc -nlvp 4444 2. Then, run this command: python3...

CVE-2024-25293

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...

kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the mlx5ibdevressrqinit function, specifically when ibcreatesrq fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial ...

CVE-2006-3592

CVE-2006-3952 Exploit for Easy File Sharing FTP Server 3.5 on Win7 32 Based on: pwntools msfvenom / reversetcp payload Vulnerable app available at https://www.exploit-db.com/apps/0efddb6d04f4125d7c1f104c6b1c60a0-efsfs.exe Simple SEH overrite + couple jumps back, due to stack being corrupted after...

PoC-CVE-2026-9198

Description Proof of concept exploit code for CVE-2026-9198 Exploit-DB entry: https://www.exploit-db.com/exploits/52675 Usage python3 poc.py -u -c...

CVE-2026-1405

CVE-2026-1405 Slider Future = 1.0.5 - Unauthenticated Arbitrary File Upload 🚀 CVE-2026-1405.py — Slider Future Mass Exploit Tool 🩸 Vulnerability Overview Component: Slider Future WordPress plugin Affected Versions: ≤ 1.0.5 Vulnerability: Unauthenticated Arbitrary File Upload CVE: CVE-2026-1405 CV...

pqaudit

pqaudit Scan codebases for quantum-vulnerable cryptography. Get a clear picture of what needs to migrate before Q-Day. pqaudit detects usage of RSA, ECDSA, Ed25519, ECDH, DH, and other algorithms broken by Shor's algorithm. It also identifies already-migrated PQC usage ML-KEM, ML-DSA, SLH-DSA so...