WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE

The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

Apache Gravitino 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage. id: CVE-2026-41042 info: name: Apache Gravitino 1.2.1 -...

CVE-2025-32433-Erlang-OTP-SSH-Unauthenticated-RCE

CVE-2025-32433 - Erlang/OTP SSH RCE PoC 개요 Erlang/OTP SSH 서버에서 인증되지 않은 원격 코드 실행 을 보여주는 PoC입니다. SSH 프로토콜 메시지 처리의 결함을 악용하면 공격자는 유효한 자격 증명 없이 대상 시스템에서 임의의 명령을 실행할 수 있습니다. CVE: CVE-2025-32433 CVSS 점수: 10.0 치명적 영향받는 버전: OTP-27.3.3 및 이전 버전 OTP-26.2.5.11 및 이전 버전 OTP-25.3.2.20 및 이전 버전 이 문제는 OTP-27.3.3,...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 - Vulnérabilité de lecture arbitraire de fichiers via la CLI peut conduire à une RCE Produits et versions concernés : Produit| Versions affectées ---|--- Jenkis Server| = 2.441 = LTS 2.426.3 CVSS : CRITIQUE Activement exploité : OUI Correctif : OUI Atténuation : OUI...

CVE-2026-29000-PoC

CVE-2026-29000 — Preuve de concept de contournement d'authentification du JwtAuthenticator de pac4j-jwt Une preuve de concept pour CVE-2026-29000 , un contournement d'authentification dans le composant JwtAuthenticator de pac4j-jwt CVSS 10.0 , Critique. Le script forge un jeton qui usurpe...

CVE-2023-35078

Outil d'exploitation CVE-2023-35078 root@kitploit: ██████╗ ███╗ ██╗███████╗███████╗ ██████╗ ██╔═████╗████╗ ██║██╔════╝██╔════╝██╔════╝ ██║██╔██║██╔██╗ ██║███████╗█████╗ ██║ ████╔╝██║██║╚██╗██║╚════██║██╔══╝ ██║ ╚██████╔╝██║ ╚████║███████║███████╗╚██████╗ ╚═════╝ ╚═╝ ╚═══╝╚══════╝╚══════╝ ╚═════╝ ...

CVE-2024-21413

CVE-2024-21413 Этот скрипт является доказательством концепции PoC уязвимости CVE-2024-21413 — значительной уязвимости безопасности, обнаруженной в Microsoft Windows Outlook, имеющей высокий критический CVSS score 9.8. Названная как MonikerLink Bug, эта уязвимость позволяет атакующему удаленно...

EUVD-2026-79427

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware component: Forms Services, C/S, Charmode. Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Téléversement sans restriction de fichier → RCE Vulnérabilité critique de téléversement sans restriction de fichier dans Elementor Pro Pouvant potentiellement conduire à une exécution de code à distance RCE ⚠️ Aperçu CVE-2026-32475 est une vulnérabilité de sécurité...

VMware Workstation 25H2, 26H1.x < 26H1u1 Multiple Vulnerabilities (VMSA-2026-0007)

The version of VMware Workstation installed on the remote host is 25H2, 26H1.x prior to 26H1u1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 809...

Linux Distros Unpatched Vulnerability : CVE-2026-80255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cook...

Exploit for CVE-2026-18366

CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Pr...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — Marimo Pre-Authentication RCE !CVEhttps:/...

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

EUVD-2026-61829

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Access and security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle...

Exploit for CVE-2025-32023

CVE-2025-32023 - Redis Remote Code Execution RCE 🚨 🧠 Ove...

Exploit for CVE-2025-26892

CVE-2025-26892 – WordPress Celestial Aura Theme = 2.2 Arbitra...

📄 AppSmith 1.47 Remote Code Execution

AppSmith version 1.4.7 suffers from a remote code execution vulnerability. Exploit Title: AppSmith 1.47 - Remote Code Execution RCE Original Author: Rhino Security Labs Exploit Author: Nishanth Anand Exploit Date: April 2, 2025 Vendor Homepage: https://www.appsmith.com/ Software Link:...