CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-37067

CVE-2026-37067 is an incorrect access control flaw in the file /vfm-admin/admin-panel/view/save-cvs.php of Veno File Manager Project 4.4.9 . An unauthenticated attacker can send a specially crafted POST request to extract all application logs from a chosen date forward, resulting in a low confide...

PT-2026-82768

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-37069

Veno File Manager Project version 4.4.9 is affected by an Absolute Path Disclosure in the file /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php. By sending a simple unauthenticated GET request to this endpoint, an attacker can determine the system directory in which the a...

CVE-2026-37071

CVE-2026-37071 affects Veno File Manager Project 4.4.9 in the Actions::renameFile() function. An authenticated attacker holding the 'reanme' permission can send a specially crafted POST request that renames the application configuration file, triggering a configuration rebuild that resets super a...

CVE-2026-37066

CVE-2026-37066 affects Veno File Manager Project 4.4.9 , where a path traversal vulnerability in the endpoints /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php leads to arbitrary file read. An authenticated attacker with the super administrator role can disclose sensitive information by sen...

PT-2026-82758

A NULL pointer dereference in the get min buffer size function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

ownCloud Improper Authentication Vulnerability

ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured...

CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing...

CVE-2026-80101

A flaw was found in the file-xwd plugin in GIMP. When processing a spe...

CVE-2020-12712

CVE-2020-12712: SOS JobScheduler में संग्रहीत पासवर्ड का डिक्रिप्शन इस रिपॉजिटरी में स्क्रिप्ट आपको JobScheduler इंस्टेंस के लिए SFTP कॉन्फ़िगरेशन फ़ाइल में संग्रहीत पासवर्ड को डिक्रिप्ट करने की अनुमति देती है। विवरण SOS JobScheduler एक रिमोट सिस्टम प्रशासन टूल है जो उपयोगकर्ताओं को वेब इंटरफ़ेस ...

vaas

Verdict-as-a-Service Verdict-as-a-Service VaaS é um serviço em nuvem que oferece recursos para escanear arquivos em busca de malware e outras ameaças. Ele permite que você integre facilmente a detecção de malware em sua aplicação com algumas linhas de código. Você pode usar o VaaS para proteger...

CVE-2019-1010268

CVE-2019-1010268에 대한 PoC 익스플로잇 작성자: Tonyynot14 Kali Linux를 사용하여 테스트됨 영감을 얻은 출처: https://www.exploit-db.com/exploits/43113 사용법 root@kitploit: python3 exploit.py -l domainname -a apppath -r /etc/passwd...

CVE-2021-29447

CVE-2021-29447 - Exploit della vulnerabilità XXE di WordPress Descrizione Questo repository contiene un exploit per CVE-2021-29447, una vulnerabilità XXE XML External Entity presente in WordPress 5.7.0 e versioni precedenti. La vulnerabilità risiede nella libreria multimediale che elabora file WA...

open-iscsi: open-iscsi: Privilege Escalation via Path Traversal

A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...

KslKatzBof

KslKatzBOF Un file oggetto beacon BOF per l'estrazione in-line delle credenziali LSASS dal C2 utilizzando la tecnica BYOVD con KslD.sys. Questo progetto si basa sul post del blog: https://avantguard.io/blog/erfahrungsbericht-ki-gest%C3%BCtzte-bof-entwicklung-im-red-team Attribuzione Questo BOF è...

cve-2022-23636-poc

CVE-2022-23626 - Esecuzione di codice remoto autenticata nel blog di m1k1o Esecuzione di codice remoto autenticata tramite una vulnerabilità di caricamento file in Blog di m1k1o v1.3 e versioni precedenti. Descrizione L'endpoint ajax.php?action=uploadimage non valida correttamente i tipi di file...

CVE-2019-11932-whatsApp-exploit

CVE-2019-11932-whatsap-exploit L'indirizzo di system e il gadget devono essere sostituiti con l'indirizzo effettivo trovato tramite una vulnerabilità di information disclosure. Dopo aver sostituito l'indirizzo di system e il gadget, esegui il codice per generare il file GIF corrotto: ora facciamo...

mssqlbof

mssqlbof Una suite di Beacon Object File per Microsoft SQL Server che parla TDS 7.4 direttamente sul filo, in C. Nessun msodbcsql.dll, nessun sqloledb.dll, nessun .NET CLR, nessun PowerShell. Un COFF per architettura, si carica in ogni beacon che rispetta l'API Beacon canonica. Perché SQL Server ...