Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2111)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2111 advisory. FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicio...

CVE-2026-17543-PHP-Exposure-Validator

Валидатор подверженности уязвимости PHP CVE-2026-17543 Безопасный сетевой валидатор для проверки потенциальной подверженности уязвимости PHP CVE-2026-17543. Этот проект проверяет, использует ли удалённый веб-сервер версию PHP, затронутую уязвимостью CVE-2026-17543, и при необходимости может...

CVE-2026-71300

CVE-2026-71300 — injection d'en-tête de répartition camel-atmosphere-websocket Reproducteur de preuve de concept exécutable pour la vulnérabilité Apache Camel où le producteur camel-atmosphere-websocket sélectionne ses destinataires WebSocket à partir des en-têtes Exchange websocket. dont les nom...

CVE-2026-82222

CVE-2026-82222 — GiveWP Auteur : Rx019 CVSS : 10.0 Critique Type : Injection d'objets PHP non authentifiée → Exécution de code à distance Plugin : GiveWP give — Plugin de dons et plateforme de collecte de fonds Versions concernées : Correctif : 4.16.8 Description GiveWP stocke le lastname d'un...

HavocPwn

Havoc-PWN Authentifié Cette chaîne SSRF-RCE a été inspirée par le POC SSRF CVE-2024-41570 de chebuya et le Havoc Auth RCE d'IncludeSecurity. Ces deux exploits sont incroyables et bien conçus, merci de témoigner votre reconnaissance à leurs créateurs pour leur travail acharné ! chebuya hyperrealit...

CVE-2026-83524

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...

CVE-2026-82971

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...

CVE-2026-83524 RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...

CVE-2026-83524

A command injection vulnerability affects the System Clock component of RedPort Optimizer wXa-203 , wXa-213 , and wXa-223 (up to version 20260704). The flaw resides in the exec function of /xgatev1/system/datetime.php, allowing a remote attacker with low privileges to inject commands without user...

CVE-2025-59528

CVE-2025-59528: PoC d'exécution de code à distance pour Flowise CustomMCP Une preuve de concept en Go pour CVE-2025-59528 ciblant les versions de Flowise = 3.0.5. Résumé Flowise permet l'exécution de JavaScript non validé via la configuration du nœud CustomMCP. L'application transmet l'entrée...

CVE-2026-82922

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flowupdatecart of the file /flow.php?step=updatecart. The manipulation of the argument recid leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...

CVE-2026-77353

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

CVE-2026-82971 QVidium Opera11 CGI Script net_tr.cgi command injection

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...

CVE-2026-82971

A command injection vulnerability in QVidium Opera11 3.3.2a26-Ax4x-opera11 affects the CGI script /cgi-bin/net_tr.cgi , where manipulation of the ipaddr argument allows remote, unauthenticated attackers to execute arbitrary commands. The vulnerability is rated CVSS 10.0 (Critical) with low attack...

CVE-2026-78329

CVE-2026-78329 — camel-undertow : stratégie de filtre d'en-têtes non appliquée injection websocket. Reproducteur fonctionnel preuve de concept de la vulnérabilité Apache Camel où UndertowEndpoint définissait par défaut sa headerFilterStrategy sur la HttpHeaderFilterStrategy de base et poussait...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Injection de variables d'environnement dans une fonction serverless via un événement Code du programme simulation Lambda Python root@kitploit: lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains...

wp2shell-rce

WP2Shell RCE Утилита для оценки и сканирования, предназначенная для обнаружения подверженности цепочке эксплойтов WP2Shell в установках WordPress Core — как на отдельных конечных точках, так и на больших списках целей. ⚠️ Дисклеймер Сканируйте только те системы, которые принадлежат вам или которые...

CVE-2026-82922 ShopEx ECShop flow.php flow_update_cart sql injection

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flowupdatecart of the file /flow.php?step=updatecart. The manipulation of the argument recid leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...

CVE-2026-82922

ShopEx ECShop versions up to 2.5.1 are affected by a remote SQL injection in the function flow_update_cart within the file /flow.php?step=update_cart. The vulnerability is triggered by manipulating the rec_id argument, allowing an unauthenticated attacker to inject SQL over the network with no us...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...