CVE-2026-39842

CVE-2026-39842: OpenRemote Expression Injection RCE in Rules Engine TL;DR Critical remote code execution vulnerability in OpenRemote's Rules Engine allows authenticated users with write:rules role to execute arbitrary code on the server with root privileges. CVSS Score : 10.0 Critical CVSS Vector...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ Classic RCE via Jolokia API TL;DR A remote code execution vulnerability in Apache ActiveMQ Classic that allows an attacker to execute arbitrary code by invoking the addNetworkConnectorString MBean operation through the Jolokia API /api/jolokia/. The attacker embed...

CVE-2026-35517

CVE-2026-35517 - Pi-hole FTLDNS Remote Code Execution tramite Newline Injection TL;DR Una vulnerabilità di Remote Code Execution nel motore FTLDNS di Pi-hole versioni dalla 6.0 alla 6.5 consente a un attaccante autenticato di iniettare direttive di configurazione dnsmasq arbitrarie incorporando...

CVE-2026-22679

CVE-2026-22679: Weaver E-cology Unauthenticated RCE via dubboApi Debug Endpoint -critical TL;DR Weaver E-cology 10.0 prior to build 20260312 contains a critical unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint. Attackers can injec...

CVE-2024-10400

CVE-2024-10400 The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the 'ratingfilter' parameter in all versions up to, and including, 2.7.6 versions Note : The exploit uses a time-based blind SQL injection check with a 5-second delay threshold. If the response time exceeds 5...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE Full unauthenticated RCE chain on n8n: 1. CVE-2026-21858 - Content-Type confusion → Arbitrary File Read 2. Read config + database → forge admin JWT 3. CVE-2025-68613 -...

CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-42208_lab

LiteLLM Proxy SQL Injection GHSA-r75f-5x8p-qvmc A reproduction environment for the SQL injection vulnerability in LiteLLM Proxy's API key authentication flow. Vulnerability Summary Item| Detail ---|--- Advisory| GHSA-r75f-5x8p-qvmc Type| SQL Injection CWE-89 Severity| Critical Affected| litellm...

CVE-2025-57833

CVE-2025-57833 Example Vulnerable application for CVE-2025–57833 Django 4.2 before 4.2.24 Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6 is vulnerable to a SQL injection via Dictionary expansion as kwargs is passed to QuerySet.annotate or QuerySet.alias Currently a work in...

CVE-2021-32099

CVE-2021-32099 CVE-2021-32099 POC : http://localhost:8000/pandoraconsole/include/chartgenerator.php?sessionid=a%27%20UNION%20SELECT%20%27a%27,1,%27idusuario|s:5:%22admin%22;%27%20as%20data%20FROM%20tsessionsphp%20WHERE%20%271%27=%271 Deatil :...

Centreon-Exploits-2026

Exploits for CVE-2026-2749, CVE-2026-2751 and CVE-2026-2750 This repository contains exploits for CVE-2026-2749, CVE-2026-2751, and CVE-2026-2750 in Centreon, exploiting Path Traversal, SQL Injection, and Command Injection vulnerabilities. Vulnerable Versions All versions prior to 25.10 24.10 24....

CVE-2026-33725

CVE-2026-33725 A proof-of-concept exploit for CVE-2026-33725, a Remote Code Execution and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import in Metabase. Vulnerable Versions Metabase Enterprise ≥ v1.47 and v1.54.22 Metabase Enterprise ≥ v1.54.0 and v1.54.22 Metabase...

CVE-2026-4802

CVE-2026-4802 - Remote Code Execution via Command Injection in Cockpit A proof-of-concept exploit for CVE-2026-4802, a Remote Code Execution via Command Injection in Cockpit's system logs UI loadServiceFilters Setup Build and run the vulnerable environment: $ docker build -t cockpit-vuln . $ dock...

CVE-2023-7028

GitLab CVE-2023-7028 POC [email protected]&[email protected] 科研机构base成都-招聘网络安全研究人员（私）...

CVE-2025-52021

CVE-2025-52021 — Time-Based Blind SQL Injection in PuneethReddyHC / Online Shopping System Advanced v1.0 CVE: CVE-2025-52021 Title: Time-Based Blind SQL Injection via productid parameter in editproduct.php Vendor / Repo: PuneethReddyHC —...

CVE-2026-4660-PoC

CVE-2026-4660 PoC Proof of concept for CVE-2026-4660 HashiCorp advisory in hashicorp/go-getter. I'm the original reporter. An attacker publishes a Terraform module with a ref of --pathspec-from-file=/path/to/file. When the victim runs terraform init, go-getter clones the repo and calls git checko...

CVE-2021-24750

How to use Start mysql, wordpress and wordpress-cli using docker-compose docker-compose -f docker-compose.yaml up -d Install wordpress, activate the plugin and create a user with the role subscriber using wordpress-cli docker-compose run --rm wp-cli install-wp Start the exploit script with an sql...

CVE-2023-22527_Confluence_RCE

CVE-2023-22527 Confluence RCE CVE-2023-22527 - RCE Remote Code Execution Vulnerability In Confluence Data Center and Confluence Server PoC References CVE-2023-22527 - RCE Remote Code Execution Vulnerability In Confluence Data Center and Confluence Server | Atlassian Support | Atlassian...

CVE-2026-31891

SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw Vulnerability Class : SQL Injection CWE-89 Product : Cockpit CMS Core Edition Affected Version : 2.13.4 and likely all versions since the Aggregation Optimizer was introduced Docker Image Tested : cockpithq/cockpit:core-2.13.4...

CVE-2022-28906-POC

CVE-2022-28906 PoC Python proof of concept for unauthenticated command injection in the TOTOLINK N600R. Vulnerability Product | TOTOLINK N600R ---|--- Firmware | V5.3c.7159B20190425 Type | OS command injection CWE-78 Parameter | langType Endpoint | /cgi-bin/cstecgi.cgi CVSS v3.1 | 9.8 Critical...