CVE-2026-59783

The Zabbix Server/Proxy is vulnerable to a Denial of Service (DoS) condition when processing binary items containing specific NULL byte input . This vulnerability leads to a crash of the service, resulting in a potential loss of availability. The issue is specific to deployments utilizing MySQL o...

CVE-2019-17137

CVE-2019-17137 Info CVE: https://vulners.com/cve/CVE-2019-17137 POC GET /index.htm%00currentsetting.htm HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Accept: / Accept-Language:...

CVE-2025-47812

CVE-2025-47812 This is a Proof of Concept PoC of the Wing FTP Server Exploit CVE-2025-47812 Description Wing FTP Server versions prior to 7.4.4 suffered a Remote Code Execution RCE vulnerability as a result of the insecure treatment of the username parameter. When we are allowed to login in the...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Bitbucket Remote Command Execution RCE Technical Analysis & Laboratory Exploitation of Null-Byte Argument Injection Vulnerability Summary CVE-2022-36804 is a high/critical Argument Injection vulnerability within the REST API of Atlassian Bitbucket Server and Data Center. While the...

bitbucket-test

Docker container to investigate CVE-2022-36804 Recreating a remote code execution vulnerability where Bitbucket fails to sanitize user input, which allows attackers to inject Git flags and execute code remotely. This repository documents how I reproduced the vulnerability CVE-2022-36804, an issue...

CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE Exploit Exploit Title: Wing FTP Server 7.4.4 Remote Code Execution via Lua Injection CVE: CVE-2025-47812 Tested on: Wing FTP Server v7.3.x Windows/Linux Impact: Remote Code Execution RCE as SYSTEM/root Severity: Critical Description A vulnerability in Wing FTP...

CVE-2021-3156

exploit.py Forked from @worawit, shorter&optimized. Only works for sudo=1.8.23 on Centos7 Works on both the web server and linux machines backdoor.php php backdoor generated through weevely, password: "H@rmWsH4rE!". Gives access to an ssh session as Apache if sucessfully uploaded to the server...

Blackash-CVE-2025-47812

🛡️ CVE-2025-47812 – Critical RCE in Wing FTP Server 🛡️ 🔎 Overview: CVE-2025-47812 is a critical remote code execution RCE vulnerability affecting Wing FTP Server versions prior to 7.4.4. It was discovered by a security researcher and has been confirmed to be actively exploited in the wild. 🧱 Root...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Unauthenticated remote code execution vulnerability in Wing FTP Server whoami root References CVE-2025-47812 W...

Lack of vulnerability protection in Fortinet FortiMail

Fortinet has identified a vulnerability in FortiMail. FortiMail contains a critical vulnerability CVE-2026-104286 in the processing of file paths, caused by a combination of Path Traversal CWE-22 and insufficient neutralization of NULL bytes CWE-158. An unauthorized attacker can use specially...

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 CVSS score: 9.8,...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287 Credits I take no credit for the original discovery and exploitation of this vulnerability. Thank you to the following people! Discovery: Daniele Linguaglossa Metasploit Module...

Orbit-Fox_SSRF_CVE-2025-10874

CVE-2025-10874 - Orbit Fox SSRF Proof of Concept Proof of concept exploit demonstrating Server-Side Request Forgery SSRF vulnerability in the Orbit Fox WordPress plugin with null byte injection bypass. Detailed blog post: https://ryanmroth.com/articles/orbit-fox-ssrf Vulnerability Details Detail|...

PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2024_9559)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249559 advisory. libsoup: infinite loop while reading websocket data CVE-2024-52532 libsoup: HTTP request smuggling via stripping null bytes from the ends of header names...

Fortinet FortiMail Path Traversal Vulnerability

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests...

CVE-2009-2265-fix

CVE-2009-2265 - Adobe ColdFusion RCE Unauthenticated remote code execution via arbitrary file upload in the FCKeditor component bundled with ColdFusion. The file upload endpoint accepts a null-byte injection in the filename parameter, allowing a JSP webshell to be uploaded and executed directly b...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1777541348)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777541348 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate th...

CVE-2026-92842

A flaw was found in PHP. When processing certain conversion stream filters with line-break settings containing a null byte, the filter duplicates the string but retains the original length rather than the truncated size. An attacker who can influence filter options could exploit this out-of-bound...