CVE-2026-23744

CVE-2026-23744 – Prova de Conceito O script Python nesta PoC envia uma simples requisição HTTP ao host alvo que executa o MCPJam inspector versão substitua pela sua porta de escuta Em seguida, abra outro shell e execute a PoC: root@kitploit: cd CVE-2026-23744 python3 exploit.py Referências RCE no...

CVE-2023-38408

Riferimento / informazioni https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt...

CVE-2023-51073

CVE-2023-51073 - Schwachstelle in der Firmware-Update-Server-Verifizierung beim Buffalo LS210D Version 1.78-0.03 Christopher J. Pace und Ryan Miller Der Buffalo LS210D ist ein Network Attached Storage NAS-Server, der für kleine Unternehmen und Privatpersonen entwickelt und vermarktet wird. Der...

CVE-2026-32746

CVE-2026-32746 - telnetd LINEMODE SLC बफर ओवरफ्लो GNU InetUtils telnetd के LINEMODE SLC Set Local Characters हैंडलर में बफर ओवरफ्लो के माध्यम से प्री-ऑथेंटिकेशन रिमोट कोड एक्ज़ीक्यूशन। CVSS 3.1: 9.8 क्रिटिकल | CWE: CWE-120, CWE-787 अवलोकन telnetd/slc.c में addslc फ़ंक्शन बिना बाउंड्स जांच के...

CVE-2026-77018

The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

EUVD-2026-66880

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

EUVD-2026-66874

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19225

Defender Security WordPress plugin versions before 6.2.0 fail to restrict a network-wide setting (via the Hub Connector ) to network administrators on multisite installations. As a result, an administrator of any single site in the network can execute arbitrary code across the entire network . Th...

WordPress Defender Security plugin < 6.2.0 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Defender Security versions 6.2.0...

CVE-2026-19225 Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

EUVD-2026-66873

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2023-46805

19/01/2024 Aggiornamento Aggiornato con le ultime informazioni basate sul blog di Assetnote. Ora vengono eseguiti tre controlli prima di mostrare uno stato, questo anche per rilevare meglio le versioni precedenti di Avanti Blog con analisi della CVE:...

CVE-2026-3288-lab

CVE-2026-3288 Vulnerable Lab Docker Injeção de Configuração no NGINX Ingress Controller ⚠️ AVISO : Este laboratório contém configurações intencionalmente vulneráveis para TREINAMENTO DE SEGURANÇA AUTORIZADO APENAS Visão Geral da Vulnerabilidade CVE-2026-3288 CVSS 8.8 ALTA - Injeção de configuração...

CVE-2026-23947-PoC

Walkthrough: CVE-2026-23947 - Orval Execução Arbitrária de Código Este walkthrough demonstra como uma especificação OpenAPI não confiável pode explorar o Orval para injetar código arbitrário em clientes gerados por meio dos campos x-enumDescriptions e x-enumNames. Pré-requisitos Node.js v20 ou v2...

CVE-2026-77991

Joomla Event Manager (a Joomla extension from joomlaeventmanager.net) versions prior to 5.0.1 are vulnerable to privileged remote code execution due to a flaw in the administrator source model , which allows writing dangerous file types including PHP. An authenticated attacker with high privilege...

CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

EUVD-2026-66866

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-0766

CVE-2026-0766: Esecuzione di Codice Remota in OpenWebUI Repository di Ricerca sulla Sicurezza a Scopo Educativo Questo repository contiene codice proof-of-concept per lo sfruttamento di CVE-2026-0766 , una vulnerabilità di esecuzione di codice remota in OpenWebUI scoperta e pubblicata dalla Zero...