vbulletin-exploits

vbulletin-exploits Exploit che prendono di mira vBulletin. CVE-2023-25135: RCE pre-autenticazione Vedi: https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable root@kitploit: ./vbulletin-rce-cve-2023-25135.py --help Usage: vbulletin-rce-cve-2023-25135.py -h -p PROXY url command...

XSS2Shell

XSS2Shell XSS2Shell è una prova di concetto educativa per CVE-2026-64638 , che dimostra l'impatto di un problema XSS pre-autenticazione nelle installazioni WordPress vulnerabili. Con la partecipazione esplicita di un amministratore, la PoC acquisisce una Application Password di WordPress, pubblic...

CVE-2023-43208-PoC

CVE-2023-43208 - Mirth Connect Nicht authentifizierte RCE Voraussetzungen Python 3.11 oder höher getestet auf 3.11, 3.12, 3.13 Einrichtung root@kitploit: Create a clean virtual environment python3 -m venv .venv source .venv/bin/activate Install pinned dependencies pip install -r requirements.txt...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server Unauthenticated RCE root@kitploit: ██╗ ██╗██╗███╗ ██╗ ██████╗ ███████╗████████╗██████╗ ██║ ██║██║████╗ ██║██╔════╝ ██╔════╝╚══██╔══╝██╔══██╗ ██║ █╗ ██║██║██╔██╗ ██║██║ ███╗ █████╗ ██║ ██████╔╝ ██║███╗██║██║██║╚██╗██║██║ ██║ ██╔══╝ ██║ ██╔═══╝ ╚███╔███╔╝██║██║...

CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...

CVE-2026-82021

Hermes Agent versions 0.18.2 prior to 0.19.0 contain a supply chain vulnerability in its bundled MCP catalog . A third-party upstream repository is referenced via a mutable branch rather than a pinned commit SHA, meaning an attacker who compromises that upstream repository can propagate malicious...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Exploit RCE del Pannello Pterodactyl Stagione 10 HTB - Writeup della macchina Pterodactyl Panoramica Obiettivo: Macchina HTB Pterodactyl Difficoltà Media CVE: CVE-2025-49132 Gravità: Critica CVSS 9.8 Tipo di attacco: Esecuzione di codice remoto non autenticata Interessati: Pannel...

EUVD-2026-67837

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

EUVD-2026-67836

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511

Yamcs is a mission control framework. In versions prior to 5.12.8 and 5.13.2 , an authenticated user holding the SystemPrivilege.ControlArchiving privilege can inject arbitrary Java into the StreamSQL aggregate expression compiler by crafting a malicious double-quoted column name. The column name...

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcher Olivier Laflamme has disclosed two independent root remote code execution RCE chains affecting the Unitree G1 EDU , including a Bluetooth Low Energy BLE path that can reach root on the robot's Locomotion PC. The flaws are tracked asCVE-2026-76639 and CVE-2026-76640 , with the...

EUVD-2026-67567

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

hikvision-unauthenticated-rce-cve-2021-36260

Vulnerabilidade RCE CVE-2021-36260 da Hikvision Descrição da vulnerabilidade Os atacantes podem usar esta vulnerabilidade para obter controle total do dispositivo com um shell root irrestrito, mesmo que o proprietário do dispositivo esteja limitado a um shell protegido limitado psh. Além de invad...

poc-CVE-2024-23897

poc-CVE-2024-23897 CVE-2024-23897: Beliebiger Dateizugriff in Jenkins führt zu RCE 🎯 Betroffene Produkte und Versionen root@kitploit: - Produkt: Jenkins Continuous Integration/Continuous Delivery Server - Versionen: Jenkins 2.441 und früher, Jenkins LTS 2.426.2 und früher - Behoben in: Jenkins...

CVE-2026-13086

A stack-based buffer overflow in the epm Endpoint Protection Manager service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: storm (UTSA-2026-093009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093009 advisory. A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially...

CVE-2026-13086 Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint

A stack-based buffer overflow in the epm Endpoint Protection Manager service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code...

CVE-2026-13086

CVE-2026-13086 affects the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS . The vulnerability is a stack-based buffer overflow that allows an unauthenticated remote attacker to execute arbitrary code, rated CVSS 4.0 9.3 (CRITICAL...

CVE-2026-48996

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...

CVE-2026-76639 Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...