CVE-2019-10758

CVE-2019-10758 PoC Configuración root@kitploit: docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js Exploit con cURL root@kitploit: curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data...

sudoinjection

CVE-2025-32463: Escalada de Privilegios Local mediante sudo -R NSS Injection Resumen Este PoC demuestra escalada de privilegios local en sistemas Linux mediante el abuso de la opción sudo -R en conjunto con un módulo NSS personalizado. Apunta a la vulnerabilidad CVE-2025-32463, que se origina en ...

CVE-2025-55182

CVE-2025-55182 Este repositorio contiene una reproducción de prueba de concepto PoC de CVE-2025-55182 , una vulnerabilidad de seguridad crítica en React Server Components RSC que permite la ejecución de código arbitrario sin autenticación. Descripción La vulnerabilidad existe en la forma en que...

CVE-2018-4121

CVE-2018-4121 - Exploit RCE de Prueba de Concepto de Secciones Wasm de Safari por MWR Labs c 2018 Detalles este exploit de prueba de concepto apunta únicamente a Safari 11.0.3 13604.5.6 en macOS 10.13.3 17D47. compile el payload de su elección como un dylib con un constructor ejecute python...

PT-2026-90720

CVE ID: CVE-2026-90560 Severity: HIGH | CVSS Score: 8.2/10 Severity and score come from CVSS ratings in the National Vulnerability Database NVD, the NIST repository of standardized vulnerability data. zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the...

CVE-2026-41242

CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4 Critical | Code Injection CWE-94 Overview protobuf.js npm: protobufjs versions ≤ 7.5.4 and ≤ 8.0.0 are vulnerable to arbitrary code execution via type names in the protobuf schema. The @protobufjs/codegen module concatenates type names...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Remote Code Execution PoC A Go proof of concept for CVE-2025-59528 targeting Flowise versions...

CVE-2025-59528-POC

CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution CVSS 10.0 Critical | Blind RCE | FlowiseAI Flowise = 2.2.7-patch.1 and 3.0.6 Overview A critical remote code execution vulnerability in the CustomMCP node of FlowiseAI Flowise. The convertToValidJSONString function passes user-supplied...

CVE-2025-59528

CVE-2025-59528 – Flowise CustomMCP Node RCE PoC Overview This repo containts proof of concept demonstrating CVE-2025-59528 in Flowise v3.0.5 The vulnerability exists in the customMCP node, where user-supplied mcpServerConfig input is processed in a way that leads to JavaScript code execution via...

PT-2026-90291

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build constructor string Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

CVE-2025-55182

CVE-2025-55182 Si buscas una explicación real, msanft/CVE-2025-55182 tiene una buena con un PoC funcional. Este repositorio solo contiene algunas cosas que probé, que arrojaron resultados interesantes más o menos. ./thing.py ahora contiene un PoC funcional, la mayor parte tomado de...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

EUVD-2026-74280

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution...

CVE-2021-42342

CVE-2021-42342 CVE-2021-42342 RCE POC1:just prints root@kitploit: include include include include static void beforemainvoid attributeconstructor; static void beforemainvoid write1, "Hello World!\n", 14; POC2: reverse shell root@kitploit: include include include include char serverip=""; uint32t...

CVE-2026-87795

A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the ZstdDictCompress constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of...

CVE-2025-55182

CVE-2025-55182 This repository contains a PoC reproduction of CVE-2025-55182 , a critical security vulnerability in React Server Components RSC that allows unauthenticated arbitrary code execution. Description The vulnerability exists in how React Server Components deserialize "Server Actions" fr...

CVE-2026-86076

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function...

CVE-2026-86076 n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function...

CVE-2026-86076

n8n , an open-source workflow automation platform, is affected by an expression sandbox escape in the Editor-UI. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the expression compiler sanitizer (the PrototypeSanitizer hook in packages/workflow/src/expression-sandboxing.ts) resolved through dy...