CVE-2026-65638

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...

CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Security Advisory: Camaleon CMS - Authenticated RCE via selecteval Custom Field Assigned CVE ID: CVE-2026-66748 Product: Camaleon CMS https://github.com/owen2345/camaleon-cms Affected versions: 2.1.1 – 2.9.1 introduced commit 415cbda6 2015-10-16; fixed commit 15882366 2026-03-29 / v2.9.2 Severity...

CVE-2026-79987 Low-privilege RCE through element-search eager loading

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE Unauthenticated Remote Code Execution RCE in WPvivid Backup & Migration 800%2C000-brightgreen?style=for-the-badge" alt="Installs" Critical flaw impacting over 800,000–900,000+ WordPress sites Unauthenticated arbitrary PHP upload → full server compromise 🌩️ Overview...

phpggc

PHPGGC：PHP 通用小工具链 PHPGGC 是一个 unserialize 载荷库，附带一个可从命令行或以编程方式生成载荷的工具 。 当你在没有源代码的网站上遇到 unserialize，或者只是想构建漏洞利用程序时，这个工具可以让你无需经历寻找小工具并将其组合的繁琐步骤，即可生成载荷。它可以被看作是 frohoff 的 ysoserial 的 PHP 等价物。...

CVE-2026-28496

CVE-2026-27604 + CVE-2026-28496 — FOSSBilling 预认证 RCE 链 执行摘要 本仓库包含一个本地 Docker 实验环境，用于复现和验证 FOSSBilling 预认证 RCE 链，该链由两个串联的漏洞组成：...

CVE-2026-20253

CVE-2026-20253 实验环境 Splunk Enterprise 通过 PostgreSQL Sidecar 服务实现预认证 RCE | ---|--- CVE| CVE-2026-20253 CVSS| 9.8 严重 类型| 未认证远程代码执行 CWE| CWE-306: 关键功能缺少身份验证 产品| Splunk Enterprise 10.0.x / 10.2.x 免责声明 ：本实验环境仅用于授权的安全研究、教育和渗透测试。请勿对您不拥有或未获得明确授权测试的系统使用。 实验架构 root@kitploit:...

CVE-2026-42533

CVE-2026-42533 实验环境 — NGINX 两遍捕获覆盖 RCE CVSS 9.2（严重） — nginx 中的预认证堆缓冲区溢出 + 信息泄露 受影响版本：nginx 0.9.6 – 1.30.3 / 1.31.2 | 已修复版本：1.30.4 / 1.31.3 架构 root@kitploit: ┌─────────────────────────────────────┐ │ 宿主机 │ │ │ PoC 脚本 ─────────┤ :8080 ──► nginx-vuln 1.26.x │ │ │ 存在漏洞 │ │ ▼ │ │ backend Python echo │...

CVE-2026-60137-and-CVE-2026-63030

wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core 预认证 RCE 实验环境 — 真实利用，RCE 服务器。 警告： 实验环境运行的是存在漏洞的 WordPress。请勿暴露到互联网。 结构 root@kitploit: . ├── docker-compose.yml Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin ├── exploit/ PoC exploit clone từ GitHub │ └── wp2shell.py Full RCE exploit ├─...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Ruby on Rails Active Storage + libvips arbitrary file read → conditional remote code execution RCE PoC tool. Single-file, Python 3.11+ pure standard library with zero dependencies , includes MAT/HDF5 hybrid payloads, a pure-Python PNG pixel decoder, offset reads,...

CVE-2025-54123

CVE-2025-54123 - Hoverfly Command Injection RCE PoC CVE-2025-54123 - Middleware Command Injection in Hoverfly 📌 CVE Details ID : CVE-2025-54123 Type : Command Injection / Remote Code Execution RCE Vendor : Hoverfly Impact : Allows authenticated attackers to execute arbitrary system commands via t...

viewstate-security-workshop

Viewstate Security Workshop This repository is for the Testing ASP.NET ViewState with YSoNet YSoSerial.NET workshop. Recommended Reading: Exploiting Deserialisation in ASP.NET via ViewState Recommended Tools For Solving The Labs when lab has been setup: https://github.com/irsdl/crapsecrets...

CVE-2026-20131-Post-Incident-Written-Report

CVE-2026-20131-事后事件书面报告 本事后事件报告分析了CVE-2026-20131的利用情况，这是思科安全防火墙管理中心（FMC）中一个严重的零日未认证远程代码执行（RCE）漏洞。本文档涵盖了通过Java对象反序列化（CWE-502）的初始入侵向量、Interlock勒索软件组织使用的威胁行为者战术、网络枚举工作流程以及取证时间线。它详细说明了根本原因调查结果、关于网络分段的经验教训，以及涵盖即时修补、账户审计和零信任实施的分阶段修复策略。...

CVE-2019-15107

Unauthenticated RCE via Webmin Backdoor CVE-2019–15107 Summary CVE: CVE-2019–15107 Affected Version: Webmin it will open an shell for you . Note: For versions 1.900–1.920, the “expired password changing” feature must be enabled for the backdoor to trigger. Version 1.890 is vulnerable in its defau...

CVE-2026-23500

CVE-2026-23500: OS Command Injection RCE via MAINODTASPDF configuration in Dolibarr Overview...

evilact

evilact Fast vulnerability scanner for CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components. Supports bulk scanning, RCE confirmation, and high-performance concurrent checks. Install root@kitploit: git clone https://github.com/cypholab/evilact.git cd evilact go...

Hadoop-YARN-RCE

Apache Hadoop YARN ResourceManager 中的未授权 RCE 当 Apache Hadoop YARN ResourceManager 的 REST API（默认端口 8088）或 RPC 端口在未启用身份验证 的情况下暴露时，存在一个未授权访问漏洞 。默认情况下，Hadoop 的 HTTP Web 控制台和 RPC 服务均未启用安全防护。这使攻击者能够远程执行任意代码或劫持集群资源。 影响 在集群节点上远程执行命令。 资源劫持（例如，加密货币挖矿、DDoS）。 通过 HDFS 访问造成数据泄露。 如果 YARN 以高权限用户身份运行，则可能发生权限提升。...

WordPress Insert or Embed Articulate Content into WordPress plugin < 4.3000000025 - Author+ Upload to RCE vulnerability

Author+ Upload to RCE vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Insert or Embed Articulate Content into WordPress versions 4.3000000025...

CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypass → isimage/mimein → PHP Webshell → RCE Overview CVE-2026-63223 is a critical-severity CVSS 9.8 unauthenticated remote code execution vulnerability in CodeIgniter 4 , a PHP full-stack web framework, affecting versions prior to 4.7.4...

cve-2025-2945-poc

pgAdmin4 查询工具认证后 RCE 漏洞利用 PoC 独立的 Python 脚本，用于利用 pgAdmin4 8.10 - 9.1 版本中查询工具的认证后 RCE 漏洞（CVE-2025-2945）。 从 Metasploit 模块移植而来：pgadminquerytoolauthenticated.rb 参考： https://vulners.com/cve/CVE-2025-2945 https://nvd.nist.gov/vuln/detail/CVE-2025-2945 https://github.com/advisories/GHSA-g73c-fw68-pwx3...