Ashwesker-CVE-2026-20045

🚨 CVE-2026-20045 — Analisi della Zero-Day 🚨 🧨 Cos'è Una vulnerabilità critica di esecuzione remota di codice RCE che colpisce diversi prodotti Cisco Unified Communications. È stata sfruttata attivamente in ambienti reali prima del rilascio delle patch. 🔥 Perché è pericolosa 🚫 Nessuna autenticazio...

proftpd-CVE-2026-42167-analysis

CVE-2026-42167 — ProFTPD modsql SQL Injection / Auth Bypass / RCE Riproduzione indipendente, analisi dettagliata della causa radice a livello di codice e una franca analisi dell'esposizione per CVE-2026-42167 — il bypass di isescapedtext nel pipeline di logging modsql di ProFTPD, divulgato da...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache = 2.4.4 Caricamento Arbitrario di File Non Autenticato fino a RCE Panoramica...

cve-2026-33937

CVE-2026-33937 - Handlebars RCE Exploit PoC Beschreibung CVE-2026-33937 ist eine kritische Remote-Code-Execution-Schwachstelle RCE in Handlebars, die durch unsichere Verarbeitung von Abstract-Syntax-Tree-Eingaben AST verursacht wird. Die Schwachstelle ermöglicht es Angreifern, beliebigen...

CVE-2026-26720-Twenty-RCE

Twenty CRM - Esecuzione Remota di Codice Autenticata RCE Panoramica Prodotto: Twenty CRM Vulnerabilità: Esecuzione Remota di Codice RCE tramite Funzioni Serverless dei Workflow Gravità: Critica Componente Interessato: Automazione dei Workflow Codice - Funzione Serverless Versione Testata: v1.15.0...

CVE-2026-1953

CVE-2026-1953 | XSS persistente — Nukegraphic CMS v3.1.2 Panoramica Una vulnerabilità di Cross-Site Scripting XSS persistente è presente in Nukegraphic CMS v3.1.2. Il problema consente a un utente autenticato di iniettare JavaScript dannoso nel campo nome del profilo , che viene salvato nel...

CVE-2026-77991

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77018

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

0vercl0k

0vercl0k PoC für CVE-2021-28476, eine „Hyper-V Remote Code Execution Vulnerability“ Gast-zu-Host-Schwachstelle in vmswitch.sys...

CVE-2026-47875

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47864

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...

CVE-2026-19225

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19223

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2021-24307-all-in-one-seo-pack-admin-rce

RCE tramite unserialization PHP admin in All in one SEO pack CVE-2021-24307 Semplice PoC di una RCE autenticata da admin in AISEO = 4.1.0.1 fornito come esempio. Analisi completa qui: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Utilizzo:...

cve-2026-40176-cve-2026-40261

CVE-2026-40176 Composer Perforce रिपॉजिटरी रिमोट कोड एक्ज़ीक्यूशन RCE 📋 सारांश Composer के Perforce रिपॉजिटरी ड्राइवर में कमांड इंजेक्शन भेद्यता, जो रिपॉजिटरी URL प्रोसेसिंग में अपर्याप्त इनपुट सत्यापन के माध्यम से रिमोट कोड एक्ज़ीक्यूशन RCE की अनुमति देती है। 🎯 भेद्यता विवरण...

CVE-2026-23520

CVE-2026-23520 PoC di Esecuzione Remota di Comandi RCE tramite API MCP 📌 Panoramica Questo repository contiene un Proof-of-Concept PoC per una vulnerabilità di Esecuzione Remota di Comandi RCE che colpisce applicazioni che espongono un endpoint API MCP vulnerabile comunemente /api/mcp/connect. La...

CVE-2026-23744-POC

CVE-2026-23744 — MCP Server Unauthenticated RCE Proof-of-Concept-Exploit vond3vn0mi Übersicht CVE-2026-23744 ist eine nicht authentifizierte Remote-Code-Execution-Schwachstelle RCE in MCP-kompatiblen Servern, die auf Port 6274 bereitgestellt werden. Der Endpunkt /api/mcp/connect akzeptiert ein...

CVE-2026-4631-cockpit-RCE

CVE-2026-4631 — Code-Analyse Cockpit: Nicht authentifizierte Remote-Codeausführung durch SSH-Befehlszeilen-Argumentinjektion...

CVE-2021-3129-Script

CVE-2021-3129 Laravel = v8.4.2 modalità debug: esecuzione remota di codice CVE-2021-3129 Uso： root@kitploit: python3 exp.py http://127.0.0.1:8888 Try to use Laravel/RCE1 for exploitation. +exploit: Laravel/RCE1 Result: Try to use Laravel/RCE2 for exploitation. +exploit: Laravel/RCE2 Result: Try t...

CVE-2026-36340

CVE-2026-36340 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critica Prodotto interessato: Krayin CRM v2.1.5 Tipo di vulnerabilità: Remote Code Execution RCE Autenticazione richiesta: S...