CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - RCE autenticado a través de la subida de plugins CVE-2025-50286 Grav CMS v1.7.48 con Admin Plugin v1.10.48 es vulnerable a Ejecución Remota de Código RCE a través de la función de subida de plugins "Instalación Directa", permitiendo a administradores...

Centry

Centry ADVERTENCIA: ESTE ES UN SOFTWARE EXPERIMENTAL. ES PROBABLE QUE CONTENGA ERRORES. Actualizaciones Si ya has instalado Centry, por favor ejecuta git pull para actualizar a la última versión. Las últimas actualizaciones lo hacen mucho más seguro contra ataques de repetición. Introducción Cent...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

SysWhispers

SysWhispers SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to Windows 10 19042 20H2. Example generated files available in the example-output/ folder. Introduction Various security products...

CVE-2021-24006

CVE-2021-24006 – FortiManager 不当访问控制利用（PoC） PoC（概念验证）- 仅用于教育目的 在 FortiManager 中滥用对 SD-WAN Orchestrator 的访问的利用程序，利用了访问控制缺陷（CWE-284）。 描述 漏洞 CVE-2021-24006 影响 FortiManager（版本 6.4.0 至 6.4.3），允许具有受限配置文件的已认证用户 直接访问 SD-WAN Orchestrator 面板的 URL，即使没有通过接口获得明确权限。 直接访问有漏洞的 URL：...

PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct

PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's...

EUVD-2026-92519

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

CVE-2026-102576 Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.6 - Unauthenticated Direct File Access vulnerability

Unauthenticated Direct File Access vulnerability discovered by J4ck13Ch4n in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.6...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: Fixed the possibility of a division-by-zero error in findhwthreadmask. The function divides the number of online CPUs by numcoresiblings, and then checks if the result is zero. This may lead to a division-by-zero...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: fixed the possible null dereference of cp The cp parameter may be null. Calling cp-cpconn would result in a null dereference. Simon Horman adds: Analysis: cp is a parameter of rdsrdmamap, and it is not reassigned. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: fbdev: vt8500lcdfb: fixed the issue where dmafreecoherent was not called when memory was freed. The fbi-fb.screenbuffer is allocated using dmaalloccoherent, but it is not freed if an error path occurs...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: jz4740: Apply DMA engine limits to maximum segment size Follow the approach used in other DMA-enabled MMC host drivers see host/mmci.c, and limit the maximum segment size based on the capabilities of the DMA engine. This is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iouring/rw: fixed the omission of the NOWAIT check for ODIRECT write operations. When iouring initiates a write operation, it calls kiocbstartwrite, which triggers the super block rwsem. This prevents any freezes from occurring...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Added a check for cstate. Since kzalloc may fail and return a NULL pointer, it would be better to check the cstate to avoid dereferencing the NULL pointer in drmatomichelpercrtcreset. Patchwork:...

lehack-2026-challenge

Reto LeHack 2026 Un reto de 3 niveles que demuestra el impacto del montaje directo de disco. Resumen del reto Nivel| Objetivo| Técnica ---|---|--- 1| Acceder al disco sin cifrar| Establecer la línea de comandos de arranque a init=/bin/bash en grub 2| Romper el LUKS de vault1| Extraer la cabecera ...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin, in versions through 1.7.6 , is vulnerable to unauthenticated direct file access. The root cause is that customer-uploaded files are stored in a publicly web-accessible uploads directory where the plugin's intended access restrictions are in...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-13607 File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2025-50286

Grav Admin Direct Install RCE CVE-2025-50286 Módulo de Metasploit y configuración de laboratorio para ejecución remota de código autenticada en la funcionalidad de instalación directa del plugin Grav Admin. Resumen CVE: CVE-2025-50286 Impacto: RCE autenticado Vector: Panel de administración →...