CVE-2025-26892

CVE-2025-26892 – Tema WordPress Celestial Aura = 2.2 Caricamento Arbitrario di File Autenticato 📄 Descrizione Una vulnerabilità di Caricamento File Senza Restrizioni è presente nel tema WordPress Celestial Aura sviluppato da dkszone fino alla versione 2.2. Un utente autenticato con privilegi bass...

CVE-2023-45828

CVE-2023-45828 RumbleTalk Live Group Chat = 6.1.9 - Autorizzazione mancante tramite handleRequest Descrizione: Il plugin RumbleTalk Live Group Chat per WordPress è vulnerabile ad accesso non autorizzato ai dati, modifica dei dati e perdita dei dati a causa di un controllo di capacità mancante sul...

CVE-2024-50475

CVE-2024-50475 Signup Page = 1.0 - Aggiornamento non autenticato di opzioni arbitrarie Descrizione: Il plugin Signup Page per WordPress è vulnerabile a modifiche non autorizzate dei dati che possono portare a escalation dei privilegi a causa di un controllo delle capacità mancante in tutte le...

DrayTek - Remote Code Execution

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. id: CVE-2020-8515 info: name: DrayTek - Remote Code Execution...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

WordPress PayPal Pro <1.1.65 - SQL Injection

WordPress PayPal Pro plugin before 1.1.65 is susceptible to SQL injection via the 'query' parameter which allows for any unauthenticated user to perform SQL queries with the results output to a web page in JSON format. id: CVE-2020-14092 info: name: WordPress PayPal Pro 1.1.65 - SQL Injection...

Apache Tomcat Servers - Remote Code Execution

Apache Tomcat servers 7.0.0 to 79 are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to t...

CVE-2026-43284

Dirty Frag: LPE universale su Linux Sommario Questo documento spiega la classe di vulnerabilità Dirty Frag, scoperta e segnalata da Hyunwoo Kim @v4bel. Combinando xfrm-ESP Page-Cache Write CVE-2026-43284 con RxRPC Page-Cache Write CVE-2026-43500, un attaccante può elevare i propri privilegi a roo...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Laboratorio di Ricerca LPE su Kernel Linux Solo a scopo educativo. NON utilizzare su sistemi senza autorizzazione esplicita. Indice Descrizione della vulnerabilità Componenti interessati Come funziona Setup del lab Docker PoC — Dimostrazione Mitigazione Riferimenti...

canarytokens-docker

Canarytokens in Docker di Thinkst Applied Research Panoramica I Canarytokens aiutano a tracciare l'attività e le azioni sulla tua rete. Se hai problemi, consulta le nostre FAQ qui, oppure apri una segnalazione e cercheremo di risponderti il prima possibile. Indice Codice di Condotta Prerequisiti...

Android-Forensics-References

Referências de Forense Android Última atualização: 22 de setembro de 2025 Partição USERDATA pasta "/log" /log/wifi/iwc/iwcdump.txt Recapitulação do Cellebrite CTF 2023: Respostas sobre o Android da Sharon https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/ /log/netstats...

[SECURITY] [DLA 4759-1] xrdp security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4759-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 29, 2026 https://wiki.debian.org/LTS -...

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake...

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated-POC Autore dell'exploit: Ashish Koli Shikari Home page del fornitore: https://github.com/pluck-cms/pluck Versione: 4.7.16 CVE: CVE-2022-26965 Informazioni: Questo script carica shell.tar su PluckCMS. L'applicazione eseguirà...

Zapscape

La trilogia dell'escape KVM ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Escape da guest a host in KVM/x86 Sommario Questo documento descrive la vulnerabilità Zapscape CVE-2026-64561 scoperta e segnalata da Hyunwoo Kim @v4bel. Si tratta di una...

CVE-2026-48908-by-yora

🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...

CVE-2020-13654

CVE-2020-13654 - XWiki Platform Scoperto e segnalato da: Astaruf Analisi completa: https://nstsec.com/en/posts/xwiki-xss-cve-2020-13654/ Voce NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-13654 Vulnerabilità XWiki Platform prima della versione 12.8 non applica la codifica HTML ai campi controlla...

Exploit for CVE-2026-82286

CVE-2026-82286 — gpt-crawler Unauthenticated Arbitrary File Wr...

Linux Distros Unpatched Vulnerability : CVE-2026-38822

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001398)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001398 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also...