CVE-2026-5027

CVE-2026-5027 - Langflow Path Traversal to Remote Code Execution Description Langflow versions up to and including 1.8.4 do not sanitize the filename parameter in the POST /api/v2/files endpoint. An attacker can use path traversal sequences ../ to write files to arbitrary locations on the...

CVE-2026-20217

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant reproduction This directory is a standalone, authorized-lab reproduction bundle for the no-account ZendTo-to-ClamAV code-execution chain and its separate default- profile Smarty/root-cron continuation. It includes: the complete runnable Po...

redis-exploitation

redis-exploitation CONFIG SET For educational purposes only Build $ docker build -t victim . Run $ docker run -d --name victim victim Attack $ docker exec -it victim bash root@34ea33cb2eb2 / ls /var/spool/cron/ root@34ea33cb2eb2 / redis-cli 127.0.0.1:6379 config set dir /var/spool/cron/ OK...

EUVD-2026-102114

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2026-110616

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

CVE-2026-110616

NullHub versions through 2026.5.29 are vulnerable to a missing authentication flaw in the */api/ management API. The root cause is that the auth_token field defaults to null and is never assigned, allowing unauthenticated attackers to access the API by sending requests without Authorization or Or...

CVE-2026-110616 NullHub through 2026.5.29 Missing Authentication for /api Management API

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

CVE-2026-110616 NullHub through 2026.5.29 Missing Authentication for /api Management API

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

CVE-2024-36821

CVE-2024-36821 The public reference that contains the minimum require information for the vulnerability covered by CVE-2024-36821 The original video with PoC you may find on the video - https://www.youtube.com/watch?v=6vHno0ik7JY The PoC: 1. Connect to the router witnin UART conenction 2. Using...

CVE-2025-57819-exploit

CVE-2025-57819 — FreePBX Pre-Auth SQLi to RCE An all-in-one exploit for CVE-2025-57819 , an unauthenticated SQL injection in FreePBX's endpoint module that leads to remote code execution via cron job injection. CVSS : 9.8 Critical — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA KEV : Added...

POC_CVE-2026-46716

CVE-2026-46716 — Nezha Monitoring Cross-Tenant RCE via Cron API Authorization Bypass A lab environment for reproducing and detecting CVE-2026-46716 , a critical vulnerability in Nezha Monitoring where the POST /api/v1/cron endpoint lacks admin privilege checks, allowing RoleMember users to achiev...

poc_monitor

pocmonitor A short scraper looking for a POC of CVE-2024-49112 Setting a cron job to run the script every 4 hours will keep the updates in place. The alerting can be customized but used Discord webhook to alert a Discord channel. 0 /4 cd /root/monitorscript && /usr/bin/python3 pocmonitor.py...

cve-2025-57819-exploit

CVE-2025-57819 Exploit Metadata Severity: Critical 9.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type: Unauthenticated SQL Injection → Remote Code Execution Affected Software: FreePBX endpoint module...

Persistnux

Persistnux A comprehensive Linux persistence detection tool for Digital Forensics and Incident Response DFIR investigations. Overview Persistnux is a bash-based tool designed to identify known Linux persistence mechanisms used by attackers to maintain access to compromised systems. It performs...

CVE-2025-57819-POC

CVE-2025-57819 — FreePBX SQL Injection → RCE PoC CVE-2025-57819 is a critical SQL injection vulnerability in FreePBX that allows an unauthenticated attacker to achieve remote code execution by chaining a SQL injection with cron job injection. ⚠️ Disclaimer : This repository is for authorized...

FreePBX-SQLi-Exploit-Privilege-escalation

FreePBX: From Unauthenticated SQL Injection to Root Shell CVE-2025-57819 • FreePBX 16.0.40.7 • HTB Connected 📋 Executive Summary This walkthrough documents the complete compromise of the HTB machine Connected. The attack chain begins with an unauthenticated SQL injection vulnerability in FreePBX,...

CVE-2026-86827

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

EUVD-2026-94748

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

PT-2026-107844

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

CVE-2026-86827: Missing Authorization

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...