CVE-2026-27944

CVE-2026-27944 - Descarga y Descifrado de Copia de Seguridad No Autenticado en Nginx UI https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red Un exploit de prueba de concepto PoC para CVE‑2026‑27944, una...

CVE-2026-48908

🚨 CVE-2026-48908 — Compromiso total del servidor mediante carga arbitraria de archivos Carga crítica de archivos no autenticada → Ejecución remota de código RCE Una vulnerabilidad crítica en SP Page Builder permite a atacantes no autenticados cargar archivos arbitrarios y lograr Ejecución remota ...

CrafterCMS-CVE-2025-6384

CrafterCMS Autenticado RCE - Bypass de Sandbox de Groovy CVE-2025-6384 Una Prueba de Concepto para una vulnerabilidad de Ejecución Remota de Código autenticada en CrafterCMS. Resumen de la Vulnerabilidad Un usuario autenticado con privilegios de desarrollador puede eludir el sandbox de scripts...

CVE-2025-14601 vsDesk Task Scheduler OS Command Injection

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...

CVE-2025-14601

vsDesk task scheduler passes unsanitized input to OS commands; an authenticated admin can inject arbitrary commands (CVSS 8.6 High). Patch available in versions 14.0101 and later from vendor https://vsdesk.ru/. No in-the-wild exploitation reported. Advisory: https://github.com/klsecservices/Advis...

CVE-2026-67357

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-26045

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available ...

PYSEC-2026-33

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances

Cybersecurity researchers have disclosed details of multiple critical-severity security flaws affecting Coolify, an open-source, self-hosting platform, that could result in authentication bypass and remote code execution. The list of vulnerabilities is as follows - CVE-2025-66209 CVSS score: 10.0...

CVE-2025-57644

Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write a...

CVE-2025-34161

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creatio...

CVE-2018-8820

An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" parameter allows remote authenticated attackers to execute arbitrary SQL commands. It is possible to upgrade access to full server compromise via xpcmdshell. In some cases, the...

CMSimple 4.4.4 RFI / Code Execution / Default Password

Exploit Title : CMSimple 4.4.4 various security vulnerability Author : Govind Singh aka NullPort Vendor : http://cmsimple.org/ Download Link : http://www.cmsimple.org/downloadcounter/dlcount/count.php?id=31 Date : 26/07/2014 Discovered at : IHT Lab 1ND14N H4X0R5 T34M Love to : Manish Tanwar,...

Cuppa CMS Remote / Local File Inclusion

Exploit Title : Cuppa CMS File Inclusion Date : 4 June 2013 Exploit Author : CWH Underground Site : www.2600.in.th Vendor Homepage : http://www.cuppacms.com/ Software Link : http://jaist.dl.sourceforge.net/project/cuppacms/cuppacms.zip Version : Beta Tested on : Window and Linux...

Wordpress Remote Command Execution

No description provided by source. Exploit Title : Wordpress All Versions Remote Command Execution Author : Nafsh Discovered By : Tapco Security & Research Lab Date : 3 Oct 2012 Home : http://Sec-Lab.Tap-Co.Net Contact : [email protected] Source :...