CVE-2022-21449-vuln-test

CVE-2022-21449 Probador de vulnerabilidad Introducción Hay una nueva CVE-2022-21449 que tiene un error en la verificación de firmas ECDSA. Es uno de los algoritmos utilizados con JWT, por ejemplo. Citando la publicación del blog Si ha implementado Java 15, Java 16, Java 17 o Java 18 en producción...

ServiceCheater

ServiceCheater Poc of CVE-2020-0113 & CVE-2020-0108 Análisis de vulnerabilidad de escalada de privilegios del servicio en primer plano de Android Antecedentes de la vulnerabilidad En el parche de AOSP de 2020-08, se reveló una vulnerabilidad en el marco AMS, con el identificador CVE-2020-0108,...

EUVD-2026-44812

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade...

CVE-2023-38408

Vulnerabilidad en OpenSSH - CVE-2023-38408 📚 Introducción Se encontró una vulnerabilidad en OpenSSH versiones anteriores a 9.3p2. La característica PKCS11 en ssh-agent de OpenSSH tiene una ruta de búsqueda insuficientemente confiable, lo que lleva a la ejecución remota de código si un agente se...

CVE-2024-38077

Este repositorio no tiene un README...

ROOT-APP-MAVEN-CVE-2026-40973 CVE-2026-40973 in org.springframework.boot:spring-boot - Patched by Root

Root has patched CVE-2026-40973 in the org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-26007 CVE-2026-26007 in cryptography - Patched by Root

Root has patched CVE-2026-26007 in the cryptography package for Root:PyPI. Multiple fixed versions available...

CVE-2026-20127-Exploit-Extension

Resumen Ejecutivo El Defensor Complementario de CVE-2026-20127 es una extensión de navegador premium de nivel empresarial diseñada para inteligencia de amenazas proactiva y análisis defensivo. Esta herramienta encapsula investigación técnica autorizada sobre la vulnerabilidad de omisión de...

Laravel Livewire v3 - Remote Command Execution

Livewire v3 Laravel contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution RCE without authentication under certain conditions. id: CVE-2025-54068 info: name: Laravel Livewire v3 - Remote Command Execution author: flame-11...

WS_FTP Server - Insecure Deserialization

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system. id: CVE-2023-40044 info: name: WSFTP Server - Insecure...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

WordPress My Calendar <3.4.22 - SQL Injection

WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route. id: CVE-2023-6360 info: name: WordPress My Calendar 3.4.22 - SQL Injection author: xxcdd severity: critical...

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

CVE-2018-6376

CVE-2018-6376 Joomla!, Inyección SQL de Segundo Orden Iniciar Joomla! root@kitploit: $ docker-compose up -d Acceder a localhost a través del navegador http://localhost:10080...

EUVD-2026-84951

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...

zerologon

Zerologon Set of scripts, to test and exploit the zerologon vulnerability CVE-2020-1472 What is it? ZeroLogon is a vulnerability that allows us to exploit a cryptography flaw in Microsoft's Active Directory Netlogon Remote Protocol MS-NRPC, which allows users to log in to servers using NTLM...

CVE-2026-19202

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...

CVE-2022-37969

CVE-2022-37969...

Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Session Fixation in Vvveb CMS v1.0.6.1 Author: Andrew Paul Date of Discovery: June 9th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.6.1 and likely prior versions CVE ID: CVE-2025-8517 Summary A Session Fixation vulnerability...

CVE-2026-95697

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...