292901 matches found
WordPress UpdraftPlus 1.26.4 Authentication Bypass Remote Code Execution
WordPress UpdraftPlus versions 1.26.4 and prior contain an unauthenticated authentication bypass in UpdraftCentral udrpc that may permit remote command execution. The included proof of concept sends forged RPC messages and can demonstrate target-side code execution...
Siemens SIMATIC IoT2050 Advanced Node-RED Unauthenticated Command Execution
Siemens SIMATIC IoT2050 Advanced Industrial OS versions prior to V4.3.4.1 with Node-RED installed do not enforce authentication on the Node-RED HTTP interface. An unauthenticated remote attacker can create malicious flows that execute arbitrary code with maximum privileges...
WordPress s2Member 260927 Remote Code Execution
WordPress s2Member plugin versions through 260927 contain a template-injection issue in the PayPal IPN itemname parameter that can lead to remote code execution. This proof of concept sends crafted IPN data and can verify command execution or test-file creation...
FreePBX Endpoint Manager 17.0.2 Unauthenticated SQL Injection
FreePBX Endpoint Manager versions before 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection vulnerability in admin/ajax.php that can create a cron job and execute commands...
Edimax BR-6478AC 2.20 Authenticated Command Injection
Edimax BR-6478AC firmware version 2.20 contains authenticated OS command injection vulnerabilities in the setWAN and formWlanMP handlers that allow commands to execute as root...
AdonisJS Bodyparser 10.1.1 Path Traversal
AdonisJS Bodyparser version 10.1.1 contains a path traversal flaw in multipart file handling that allows an attacker to write files outside the intended upload directory. This proof of concept provides a Dockerized reproduction. https://packetstorm.news/download/239447...
OPPO PHQ110 C.53 Kernel Local Privilege Escalation
OPPO PHQ110 version C.53 with kernel 5.4.254-qgki contains a local privilege escalation vulnerability in PI futex locking. Included is a proof of concept that obtains temporary uid 0. https://packetstorm.news/download/239440...
React Server Components 19.2.0 Remote Code Execution
React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 contain a remote code execution vulnerability. The included proof of concept sends a crafted Server Function request to execute the id command. https://packetstorm.news/download/239455...
Chatwoot 4.15.0 Unauthenticated ActiveStorage Direct Upload
Chatwoot version 4.15.0 contains an authentication bypass in its ActiveStorage direct upload endpoint that allows unauthenticated blob creation and arbitrary file writes. This proof of concept can achieve remote code execution where uploaded PHP content is executable...
unixODBC 2.3.14 SQLLEN Integer Truncation
unixODBC versions through 2.3.14 contain a 64-bit SQLLEN buffer-length truncation in cursor-library SQLBindCol handling. The supplied proof of concept demonstrates that a crafted buffer length can produce an invalid copy during a fetch, crashing the application. unixODBC versions =2.3.14 contain ...
WordPress Bricks Builder 1.9.6 Remote Code Execution
WordPress Bricks Builder versions through 1.9.6 contain an unauthenticated code injection flaw permitting remote PHP command execution. The proof of concept retrieves a nonce and sends crafted render-element requests. https://packetstorm.news/download/239466...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
The php2shell Recipe One recipe, any unpatched build → RC...
Exploit for CVE-2026-98432
CVE-2026-98432 temporary mitigation CVE-2026-98432 is a use-a...
Exploit for CVE-2026-80587
No d...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182: React Server Components Flight 프로토콜 역직렬화 원격 코드...
Exploit for Out-of-bounds Read in Polkit_Project Polkit
CVE-2021-4034 я разобрал уя...
Exploit for Out-of-bounds Write in Apple Ipados
CVE-2026-112689 — H.264 MMCO DPB Out-of-Bounds Write Crash-on...