CVE-2024-10124

CVE-2024-10124 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce = 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation Description The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized...

CVE-2026-80626

A flaw was found in the Linux kernel's powerpc/perf component. An issue in the fslembpmudel function can lead to a preempt count underflow. This occurs when the function attempts to decrement a preemption counter without a corresponding increment, specifically when event-hw.idx is negative. On...

CVE-2021-31630

CVE-2021-31630 CVE encontrada al jugar con una máquina de HTB. El exploit de exploit-db tiene algunos errores, por lo que se proporciona una forma manual de explotación y un exploit. Uso del script Ejecución de comandos sin salida visible root@kitploit: python exp.py -u http://127.0.0.1:8080 -l...

GZDoom-Arbitrary-Code-Execution-via-ZScript-PoC

GZDoom = 4.13.1 Ejecución de Código Arbitrario a través de ZScript Malicioso Una prueba de concepto para una vulnerabilidad de ejecución de código arbitrario que encontré en la funcionalidad ZScript de GZDoom https://github.com/zdoom/gzdoom. Un atacante puede compartir un archivo PK3 que contenga...

CVE-2026-83772

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

CVE-2025-61228

CVE-2025-61228 Alerta Este problema parece ser peor de lo que el desarrollador sugiere, así que no quiero que esta parte se pierda en la maleza. El desarrollador señaló en su blog: Esto solo puede suceder si un programa que se ejecuta en su sistema está buscando a SuperDuper para realizar una...

CVE-2025-68613

CVE-2025-68613 n8n es una plataforma de automatización de flujos de trabajo de código abierto. Las versiones a partir de 0.211.0 y anteriores a 1.120.4, 1.121.1 y 1.122.0 contienen una vulnerabilidad crítica de Ejecución Remota de Código RCE en su sistema de evaluación de expresiones de flujo de...

CVE-2025-55182

🚨 CVE-2025-55182 — React2Shell CVE-2025-55182 is a critical Remote Code Execution RCE vulnerability affecting React Server Components RSC. 📌 Overview This vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable servers. The issue originates from unsafe deserializati...

Email-exploit-Moniker-Link-CVE-2024-21413-

Exploit de correo electrónico Moniker Link-CVE-2024-21413-Module — Documentación Resumen: Un PoC práctico que demuestra el uso de un Moniker Link en un correo HTML para desencadenar una conexión SMB desde Outlook, permitiendo capturar el hash netNTLMv2 de la víctima mediante Responder. Esto...

Rockwell Automation Historian ME

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could crash the device being accessed; an out-of-bounds write condition may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these...

HiveV5_file_decryptor

HiveV5 file decryptor PoC Introduction The work done in the last few months has been necessary to reveal the malicious file encryption mechanism of Hive v5-5.2. The work was divided into two parts 1. Keystream decryption 2. File decryption using the decrypted keystream I would like to thank the...

peafl64

Overview peafl64 is a static instrumentation tool for x64 PEs in Windows. Static instrumentation is the practice of editing executable files and adding code to specific locations in them. The instrumentation adds code to the start of every basic block in the binary, logging the execution flow in ...

BumbleCrypt

BumbleCrypt A Bumblebee-inspired Crypter Background The BumbleCrypt is inspired by Bumblebee's crypter, in Bumblebee's case the main Bumblebee DLL is been loaded in the memory and executed in the following way: Decrypts and writes the payload in the Heap Hooks three NtApi's - NtOpenFile,...

NimDllSideload

Nim DLL Sideloading This repo allows you to easily generate Nim DLLs you can use sideloading/proxy loading. If you're unfamiliar with what DLL sideloading is, take a gander at this blog post. How do I use this? Put the legit DLL or multiple DLLs you want to proxy into the build directory of this...

venom-rs

Shellcode Reflective DLL Injection sRDI in Rust Codename: Venom Shellcode reflective DLL injection sRDI is a process injection technique that allows us to convert a given DLL into a position-independent code which can then be injected using our favourite shellcode injection and execution techniqu...

ManualRsrcDataFetching

ManualRsrcDataFetching: one function to replace FindResource & LoadResource & LockResource & SizeofResource windows apis. Note: Payload.ico is a x64 calc shellcode...

Shockwave-OSS

BountyTricks Sharing Bug Bounty tips and tricks with the community including but not limited to automation, one liners and useful thoughts Cyllabus 💂‍♂️ Misc Regex Validator Homograph Generator Shodan-Scripts HTTP Headers MIME Types Reverse-Proxies Writeups HTTP Request Smuggling Github local recon...

CVE-2024-4577-RCE-PoC

CVE-2024-4577 RCE Exploit While implementing PHP, the team did not notice the Best-Fit feature of encoding conversion within the Windows operating system. This oversight allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by specific character sequences. Arbitrary...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2025-15403

CVE-2025-15403 RegistrationMagic 📡 La información exclusiva llega aquí primero. Sigue a @KNxploited en Telegram: divulgaciones precisas de CVE, exploits funcionales e investigación profunda de vulnerabilidades. El canal para quienes no esperan las noticias, sino que las crean. 🧠 Resumen...