Cartero

Cartero Cartero is now a Go CLI with an embedded, no-configuration workspace database instead of the old MongoDB-dependent runtime. The current implementation provides: a polished terminal experience powered by Cobra and Lip Gloss a local admin web UI and safe testing pages via cartero serve...

unlicense

Unlicense Una herramienta de Python 3 para desempaquetar dinámicamente ejecutables protegidos con Themida/WinLicense 2.x y 3.x. Advertencia: Esta herramienta ejecutará el ejecutable de destino. Asegúrate de usar esta herramienta en una VM si no estás seguro de lo que hace el ejecutable de destino...

CVE-2022-2992

CVE-2022-2992 Ejecución remota de comandos autenticada en Gitlab mediante la importación de GitHub. Una vulnerabilidad en GitLab CE/EE que afecta a todas las versiones desde 11.10 anteriores a 15.1.6, todas las versiones desde 15.2 anteriores a 15.2.4, todas las versiones desde 15.3 anteriores a...

CVE-2022-35650

CVE-2022-35650 Esto es una lectura arbitraria de archivos en Moodle. Requisitos previos Debes haber comprometido un usuario a nivel de profesor o administrador. Pasos 1. Clona este repositorio: git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. Ejecuta este comando para comprimir el...

CVE-2015-9331

CVE-2015-9331 POC Descripción de la vulnerabilidad CVE-2015-9331 es una vulnerabilidad de carga de archivos arbitrarios en el plugin de WordPress WP All Import. Esta vulnerabilidad permite a un atacante no autenticado cargar archivos arbitrarios en el servidor, lo que podría provocar la ejecución...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

CVE-2026-103437

CVE-2026-103437: ReadingLists imported canonical URL XSS Reporter: Marco Paciaroni BomboBombone. ReadingLists accepted an imported project URL and used the response's canonicalurl as a card link without checking its scheme. A signed-in visitor who opened a crafted import link and clicked the card...

CVE-2023-36123

CVE-2023-36123 Solo para fines de demostración. El exploit funciona en todas las versiones de Plain Craft Launcher 2. Descarga Custom.xaml e impórtalo en Plain Craft Launcher 2, luego haz clic en "Run Command". https://github.com/Hex-Dragon/PCL2/assets/140469824/636d1436-a26d-4f54-ad4f-a7b1bb1237...

CVE-2025-31125

CVE-2025-31125 Exploit - Vite WASM Import Path Traversal 🛡️ Este script es un exploit prueba de concepto PoC para CVE-2025-31125 , una vulnerabilidad encontrada en Vite. El exploit aprovecha un problema de WASM Import Path Traversal para recuperar archivos sensibles de servidores vulnerables que...

CVE-2024-25641-Exploit-for-Cacti-1.2.26

Exploit CVE-2024-25641 para Cacti 1.2.26 Explotando CVE-2024-25641 en Cacti 1.2.26. Cuando un usuario está autenticado, una vulnerabilidad de escritura arbitraria de archivos permite la Ejecución Remota de Código RCE. Resumen Este script automatiza el proceso de explotación de CVE-2024-25641 en...

CVE-2019-15896

CVE-2019-15896 LifterLMS = 3.34.5 - 인증되지 않은 옵션 가져오기 설명 인증되지 않은 옵션 가져오기, 이로 인해 다음이 발생할 수 있습니다: 웹사이트 리디렉션 관리자 계정 생성 콘텐츠 삽입 저장형 XSS 이 문제들은 3.35.0에서 수정되었다고 보고되었습니다. 그러나 v3.35.1에서는 추가적인 입력 정리 및 필터링이 추가되었습니다. 사용 방법 $ python3 CVE-2019-15896.py --url http://wordpress.lan --username radmin --email...

CVE-2025-39538

🛡️ CVE-2025-39538 - WordPress WP-Advanced-Search = 3.3.9.3 Subida Arbitraria de Archivos CVE-2025-39538 Publicado: 2025-04-16 Tipo de Vulnerabilidad: Subida Arbitraria de Archivos Subida sin Restricciones de Archivos con Tipo Peligroso Plugin Afectado: WP-Advanced-Search por Mathieu Chartier...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-103293

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to unauthenticated data disclosure. The root cause is the failure to use a site-specific secret when deriving the storage location for import logs within the uploads directory , combined with a lack of direct acces...

CVE-2026-80517 WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-80517 WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

EUVD-2026-91933

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

CVE-2026-103293

The MPG WordPress plugin before version 4.2.3 is vulnerable to an arbitrary file read flaw. The root cause is a failure to validate that a dataset source supplied during project import is a remote URL; instead, the system treats it as a local filesystem path and copies the content into a publicly...