CVE-2023-43770-PoC

CVE-2023-43770-PoC PoC for Stored XSS CVE-2023-43770 Vulnerability Description Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior. Attack Chain Crafted...

CVE-2022-29337

CVE-2022-29337 C-DATA FD702XW-X-R430 v2.1.13X001 was discovered to contain a command injection vulnerability via the vacmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request...

printix-CVE-2022-29554

CVE-2022-29554 Simple Release | Print Friendly A "Mishandling of Input to API" or "Exposed Dangerous Method or Function" vulnerability in PrintixService.exe, in Kofax Printix's "Printix Secure Cloud Print Management", Version 1.3.1156.0 and below allows a Local Or Remote attacker the ability to...

CVE-2025-59059-Misattributed-RCE-in-Apache-Ranger-Static-Analysis-Correction

CVE-2025-59059: Misattributed RCE in Apache Ranger a correction CVE: CVE-2025-59059 Affected versions: Apache Ranger "Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions = 2.7.0." this is wrong, or at least misleading. NashornScriptEngineCreator...

CVE-2026-5201

CVE-2026-5201 Heap-based buffer overflow in gdk-pixbuf JPEG loader Hi, I'm Kağan Çapar. I discovered a heap-based buffer overflow vulnerability in gdk-pixbuf's JPEG image loader that affects virtually all Linux desktop environments. The vulnerability was assigned CVE-2026-5201 and acknowledged by...

EUVD-2026-101839

The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-86803

The Ocean Extra plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in versions up to and including 2.6.0 . The flaw exists because the software allows the execution of an action that fails to properly validate a value before calling the do_shortcode function, spec...

CVE-2026-86803 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template

The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2018-2628

CVE-2018-2628 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Detailed Steps to Reproduce CVE-2018-2628: 0x01 Run the following command on the JRMPListener host: wget https://jitpack.io/com/github/frohoff/ysoserial/master/ysoserial-master.jar java...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: docker build -t...

CVE-2023-46604-RCE

CVE-2023-46604-RCE Vulnerability A deserialization vulnerability in the OpenWire transport unmarshaller in Apache ActiveMQ. Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to 5.16.6, and all versions before 5.15.16. Setup Change the Values inside the...

CVE-2026-48909

CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...

CVE-2026-48800-PoC

CVE-2026-48800 — Notepad++ Arbitrary Code Execution PoC Severity: High | Affected: Notepad++ ≤ 8.9.6 | Patched: v8.9.6.1 A PoC script for CVE-2026-48800, an arbitrary code execution vulnerability in Notepad++ ≤ 8.9.6 via shortcuts.xml. For full technical details, see the official security advisor...

BotCon

BotCon Attlasian Confluence Un-Authenticated Remote Code Execution via OGNL Injection CVE-2022-26134 On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Data Center applications, highlighting a critical severity unauthenticated remote code execution...

CVE-2025-32432

🔐 CVE-2025-32432 — Craft CMS Pre-Auth RCE Pre-Authentication Remote Code Execution in Craft CMS Discovered & Developed by Mohammed Idrees Banyamer 📌 Overview CVE-2025-32432 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting multiple versions of Craft CMS. By chaini...

PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE This repository contains a Proof of Concept PoC for the vulnerability CVE-2025-62222. It demonstrates how Remote Code Execution RCE can be achieved on a developer's machine by manipulating the context of GitHub Copilot Chat in VS Code via hidden promp...

CVE-2024-3640_WafBypass

CVE-2024-3640 WafBypass woodpacker Plugin Exploitation The bypass method is essentially inserting XML comment markers to bypass keyword filtering. Delay Detection Echo Command Execution Custom Memory Shell...

CVE-2026-108587

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2023-41425

CVE-2023-41425 Description A Cross Site Scripting vulnerability in Wonder CMS Version 3.2.0 to Version 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. This is a modifed version of the original exploit by prodigiousMind which...

CVE-2023-42222

CVE-2023-42222 Vulnerability summary WebCatalog before version 48.4.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances. This vulnerability allows an attacker to execute code on the victims machine by sending...