CVE-2020-29607-Pluck-CMS-4.7.13-Authenticated-File-Upload-RCE-PoC

CVE-2020-29607 — Pluck CMS Ejecución remota de código autenticada en Pluck CMS anterior a 4.7.13. El administrador de archivos admin.php?action=files no valida las extensiones de archivo, permitiendo la subida de archivos .phar que Apache ejecuta como PHP. Subir una webshell a través de este...

CVE-2026-97230

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

CVE-2025-69600

CVE-2025-69600 author: Rafael José Núñez Gulías company: Iberian Var Group Affected products: RayVentory Scan Engine 12.6 Update 8 and previous versions Raynet advisory: RSEC200966 Command injection in Raynet's rvia allows adversaries to execute commands via getconfig, upload, inventory, and orac...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic 5.19.4, and 6.0.0 – 6.2.2 Fixed in:...

Arbitrary-File-Read-CVE-2024-24919

Lectura Arbitraria de Archivos CVE-2024-24919 Aquí está la alerta recibida en el SIEM Primero, ¿qué es CVE-2024-24919? Aquí está la descripción en el sitio web del NIST. Después de investigar más, CVE-2024-24919 es un ataque de path traversal, lo que explica la solicitud realizada al directorio...

CVE-2025-10307

Exploit: Arbitrary File Deletion via Backuply tarfile path traversal Browser Console PoC authenticated admin root@kitploit: async = const page = $location.origin/wordpress/wp-admin/admin.php?page=backuply; // 1 Extract a valid nonce from the Backuply page const html = await fetchpage, credentials...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - Unauthenticated Privilege Escalation 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Unauthenticated Privilege Escalation 📌 Overview This repository contains a Python proof-of-concept tool for CVE-2025-39459 , affecting the Real Estate 7 WordPress theme in versions...

CVE-2024-3094-Checker

CVE-2024-3094-Checker The repository consists of a checker file that confirms if your xz version and xz-utils package is vulnerable to CVE-2024-3094. Disclaimer: 1. This script is provided without any warranty, express or implied. 2. By choosing to execute this script, you accept full...

CVE-2025-56399

CVE-2025-56399 Mass Exploit CVE-2025-56399 – Remote Code Execution in laravel-file-manager v3.3.1. Exploits misconfigured config in Laravel File Manager to upload and verify a PHP shell via unauthenticated file upload. Installation Download repository root@kitploit: git clone...

SNet

SNet 日本語版はこちら / Japanese version Un CTF donde usas IA para capturar la bandera. ¿Sin experiencia en pentesting? No hay problema. Claude Code actúa como tu entrenador personal: configura el entorno, te enseña las herramientas y te guía a través de técnicas de ataque reales paso a paso. Tú escribes...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus Suscriptor autenticado → Administrador mediante la acción AJAXdo-reinstall 〔 1 〕 Vulnerabilidad Causa raíz: Ajax::handlerequest registra la acción AJAX demoimporterplus sin llamar a currentusercan. Cualquier suscriptor autenticado puede enviar...

CVE-2025-5688-FreeRTOS-Plus-TCP-Out-of-Bounds-Write

CVE-2025-5688 – FreeRTOS-Plus-TCP Out-of-Bounds Write Exploit Remote memory corruption / DoS / potential RCE trigger in FreeRTOS-Plus-TCP when processing overly long DNS names in LLMNR or mDNS queries Buffer Allocation Scheme 1. Exploit Author: Mohammed Idrees Banyamer Country: Jordan Instagram:...

0-click-RCE-Exploit-for-CVE-2024-9932

CVE-2024-9932 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858329238153072668 This repository contains a proof-of-concept exploit for CVE-2024-9932, an unauthenticated arbitrary file upload vulnerability in the Wux Blog Editor WordPress plugin, leading to...

HTB-Mailing-A-Complete-Walkthrough

HTB: Mailing — Una guía completa Por Mursalin Si has estado machacando máquinas de HackTheBox, Mailing es una de esas cajas que realmente te enseña algo. Está clasificada como Fácil, corre en Windows, y encadena varias vulnerabilidades del mundo real: un directory traversal, una filtración de...

CVE-2026-97230

The IO::Socket::SSL::SelfCertificate module (version 1.00 ) for Perl contains malware that executes arbitrary code. The generate_certificate function runs a Python script disguised as a certificate file, located at lib/Crypt/SelfCertificate/sample/cert.pem. This script retrieves and executes code...

CVE-2026-97230 IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

CVE-2026-97230 IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

Security Bulletin: IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service [CVE-2026-84414]

Summary IBM i is vulnerable to allowing a local authenticated attacker to change the ownership of certain files due to running with excessive permissions CVE-2026-84414 in Network Authentication Service NAS as described in the vulnerability details section. Vulnerability Details...

Security Bulletin: IBM i is Affected By a Cross-Site Scripting Vulnerability in Navigator for i [CVE-2026-75838]

Summary IBM Navigator for i uses DOMPurify for HTML sanitization. DOMPurify is vulnerable to cross-site scripting due to failure to neutralize detached subtrees in element-removal hooks CVE-2026-75838 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-75838...

CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” A critical unauthenticated remote code execution vulnerability in an open-source workflow automation platform. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Impact Exploitation Detection Remediation Mitigation Summary 🔎 Overview...