CVE-2025-55182

CVE-2025-55182 Questo repository contiene una riproduzione di Proof of Concept PoC per CVE-2025-55182 , una vulnerabilità critica di sicurezza in React Server Components RSC che consente l'esecuzione di codice arbitrario non autenticata. Descrizione La vulnerabilità risiede nel modo in cui React...

CVE-2025-55182

CVE-2025-55182 - React2Shell PoC CVE-2025-55182（CVSS 10.0）关键未认证远程代码执行漏洞的概念验证利用程序，影响 React Server Components。 致谢 发现者：Lachlan Davidson - 于2025年11月29日向 Meta/React 团队披露。 漏洞概述 该漏洞存在于 React Flight 协议的反序列化逻辑中。通过 HTTP POST 发送恶意负载，攻击者能够实现原型污染，进而导致在服务器上执行任意代码。 受影响版本...

CVE-2026-35616

🚨 CVE-2026-35616 - Bypass dell'Autenticazione di FortiClient EMS 🚨 Controllo degli accessi improprio | Bypass API pre-autenticazione Sfruttata in the Wild — Aprile 2026 📋 Panoramica CVE-2026-35616 è una vulnerabilità critica in FortiClient Enterprise Management Server EMS versioni dalla 7.4.5 all...

sqlsure

sqlsure KI schreibt dein SQL. sqlsure stellt sicher, dass es richtig ist. Eine Abfrage kann vollkommen gültig sein, fehlerfrei laufen und eine Zahl zurückgeben, die stillschweigend falsch ist – Umsatz durch einen Join doppelt gezählt, ein Durchschnitt summiert, eine Patienten-ID offengelegt...

CVE-2025-60655

CVE-2025-60655 - Esecuzione di codice in remoto RCE tramite upload senza restrizioni | ---|--- Ricercatori| DotAdrien Gravità| 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Software...

CVE-2022-25765-exploit

CVE-2022-25765 — Iniezione di comandi in pdfkit Descrizione CVE-2022-25765 è una vulnerabilità di iniezione di comandi Command Injection che colpisce pdfkit gem Ruby nelle versioni 0.8.7.2. La vulnerabilità ha una severità CRITICA con CVSS 9.8, poiché consente l'esecuzione remota di comandi senza...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Cross-Site Scripting Memorizzato Non Autenticato Uso Rapido root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Note di Sfruttamento Gravità: CRITICAL CVSS: 9.8 Impatto: Riservatezza, Integrità, Disponibilità Pubblicato:...

CVE-2017-14980_syncbreeze_10.0.28_bof

Exploit - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 Questa repository contiene un proof-of-concept exploit di buffer overflow BOF per Sync Breeze Enterprise versione 10.0.28, che sfrutta la vulnerabilità identificata come CVE-2017-14980. Descrizione La vulnerabilità è dovuta a una non...

CVE-2026-75357

Bilibili Desktop v.1.17.9 contains a vulnerability in the bili-inject.js and bili-bridge.js components that allows a remote attacker to execute arbitrary code . The specific root cause is not detailed in the provided documents. No patch version, workaround, or confirmed in-the-wild exploitation i...

CVE-2026-26899

luci-app-https-dns-proxy on OpenWrt contains a command injection vulnerability in the setInitAction function (/usr/libexec/rpcd/luci.https-dns-proxy). Authenticated users can execute arbitrary shell commands by injecting shell metacharacters through the name parameter. The flaw was addressed in P...

PT-2026-82602

openssl encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation path...

EUVD-2026-67100

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

EUVD-2026-67122

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

PT-2026-82772

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

PT-2026-82793

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-35869

CVE-2026-35869 is a command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library on the LB-link Router AC450M V4.0.0 . The root cause is insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution contex...

CVE-2026-37003

Agno (up to and including version 2.5.8 ) is vulnerable to Remote Code Execution via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attac...

CVE-2026-30612

Time4 Popcorn is a cross-platform application affected by a vulnerability in its updater components. In Windows versions up to 6.2.1.18, the flaw resides in updater.exe ; on MacOS versions up to 6.2.1.17, it affects PT.updd ; and on Android versions up to 3.5.0.173, the same class of issue applie...

CVE-2026-35868

A Command Injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-link Router AC2100_AZ3 V1.0.4 . The root cause is insufficient validation and sanitization of user-supplied input before it reaches a system-level command execution context. An attacker...

CVE-2026-37004

BerriAI litellm versions up to and including 1.82.4 are affected by a Server-Side Template Injection (SSTI) vulnerability. The root cause is the use of an unsandboxed jinja2.Environment in the /prompts/test endpoint, which allows unauthenticated remote attackers to execute arbitrary OS commands b...