@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary File Upload → RCE CVSS 9.8 Critical · Affected: Forminator = 1.56.1 · Patched: 1.56.2 Researcher: daroo Wordfence Bug Bounty, $2,048 · 600k active installs Writeup:...

CVE-2026-25731

Server-Side Template Injection SSTI in Templite Engine Severity: High CVSS 7.8 Affected Software: calibre Patched In: 9.2.0 Advisory: GHSA-xrh9-w7qx-3gcc Summary A Server-Side Template Injection SSTI vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user...

CVE-2025-10353-POC

CVE-2025-10353 POC - File Upload RCE 🛠️ POC for CVE-2025-10353: A file-upload vulnerability in the melis-cms-slider module of Melis Platform that can lead to remote code execution RCE when an attacker uploads a malicious file via the mcsdetailimg parameter to: root@kitploit:...

CVE-2023-34836

CVE-2023-34836 — eScan Management Console 14.0.1400.2281: Reflected Cross-Site Scripting XSS Overview CVE ID: CVE-2023-34836 Vulnerability Type: Reflected Cross-Site Scripting XSS Affected Product: Microworld Technologies eScan Management Console Affected Version: 14.0.1400.2281 Severity: Medium...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: Reflected Cross-Site Scripting XSS Overview CVE-2023-34837 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GrpPath POST...

reverse-shell

reverse-shell Reverse Shell como servicio - https://reverse-shell.sh Reverse shell fácil de recordar que debería funcionar en la mayoría de sistemas tipo Unix. Detecta el software disponible en el objetivo y ejecuta un payload apropiado. Uso 1. Escucha la conexión En tu máquina, abre un puerto y...

CVE-2018-16763_fuel_cms_exploit

⚠️ Disclaimer This project is strictly for educational and ethical security research purposes only. All activities were performed in a controlled lab / CTF environment. Do not use the techniques described here on any system without proper authorization. 🎯 Objectives Identify potential attack...

CVE-2024-4577-checker

CVE-2024-4577 Vulnerability Checker The CVE-2024-4577 Vulnerability Checker is a Bash script designed to scan multiple domains for the CVE-2024-4577 vulnerability in PHP-CGI. This tool allows security researchers and system administrators to quickly assess whether their systems or a list of domai...

CVE-2020-14321

CVE-2020-14321 Course enrolments allowed privilege escalation from teacher role into manager role to RCE Maybe someone needs Python script, therefore, I have written it to exploit. How to use this PoC: root@kitploit: How to use this PoC script Case 1. If you have vaid credentials: python3...

day08-CISCO-fmc-sim

Día08 — Simulación de RCE de Gestión estilo Cisco FMC Esta es una simulación educativa mínima que demuestra la clase de impacto de un RCE de análisis del plano de gestión inspirado en CVE-2025-20265. Ejecuta intencionalmente comandos a partir de una entrada manipulada solo para aprendizaje local...

CVE-2026-25769

CVE-2026-25769 what is CVE-2026-25769 ? CVE-2026-25769 is a critical Remote Code Execution RCE vulnerability in Wazuh, the open-source security platform used for threat prevention, detection, and response. what is wazuh ? Wazuh is a free and open-source security platform used for threat preventio...

Important: Red Hat Security Advisory: ansible-core security update

An update for ansible-core is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

CVE-2026-0770

CVE-2026-0770 Overview This tool is used to test the vulnerability CVE-2026-0770 in the Langflow application. It leverages the /api/v1/validate/code endpoint to perform Remote Code Execution RCE. Developer: Ohang Thanks to: @C4p333 Purpose: Security Research & Educational Use Installation Termux...

CVE-2025-55182

CVE-2025-55182 Batch Detection Tool Efficient batch detection tool for the Next.js prototype pollution vulnerability CVE-2025-55182. Vulnerability Overview CVE-2025-55182 is a prototype pollution vulnerability in the Next.js framework. Attackers can exploit prototype pollution by crafting malicio...

CVE-2026-67206

CVE-2026-67206 - Wolf CMS = 0.8.3.1 - RCE via Arbitrary File Write This repo contains a Proof of ConceptPoC exploit for CVE-2026-67206 Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have...

CVE-2026-41089-Netlogon-RCE

🛡️ CVE-2026-41089-Netlogon-RCE - Analice vulnerabilidades críticas de servicios de Windows Este repositorio proporciona herramientas para analizar y probar la vulnerabilidad de Netlogon conocida como CVE-2026-41089. Esta herramienta ayuda a los profesionales de seguridad a identificar si sus...

CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are...

CVE-2026-30502-OpenKM-6.3.12-Reflected-XSS

🛡️ CVE-2026-30502 — XSS Reflejado en OpenKM v6.3.12 Descubierto e informado porDharmendra Kumar — Investigador de Seguridad Ciberseguridad | Pruebas de Penetración | Investigación de Vulnerabilidades | Divulgación Responsable 📌 Tabla de Contenidos Resumen Detalles del CVE Producto Afectado...