EUVD-2026-92043

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system (CMS) like 1C-Bitrix. This feature allows unauthorized users to execute arbitrary code by enabling unlimited uploading of dangerous types of files.

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the CodeScoring software development platform lies in its inability to eliminate special elements from the template creation mechanism, allowing attackers to execute arbitrary code.

The vulnerability of the CodeScoring software development platform lies in the lack of measures to neutralize special elements within the template creation mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system, which stems from the lack of authentication for a critical function, allows attackers to execute arbitrary code.

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the VoIP gateway software Telecom MG, related to improper code generation, allows a hacker to execute arbitrary code.

The vulnerability of the VoIP gateway software of Telecom MG is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the FOQUZ platform, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary code.

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the CrocoTime employee working time management system, related to the lack of measures taken to protect the website structure, allows a perpetrator to execute arbitrary codes.

The vulnerability in the CrocoTime employee working hours tracking system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

CVE-2024-47176

CVE-2024-47176 CUPS Common UNIX Printing System — это система печати, которая использует такие протоколы, как IPP Internet Printing Protocol, для управления задачами и очередями печати. 27 сентября 2024 года в интернете были опубликованы детали удалённого выполнения кода в Unix CUPS, цепочка...

CVE-2024-22891

Nteract PoC CVE-2024-22891 の脆弱性に対する Proof-Of-Concept（実証コード）です。 nteract 0.28.0 は Markdown リンクを介して Electron WebView を許可するため、リモートコード実行（RCE）が発生します。 このリポジトリには、脆弱なアプリケーションの例と、それに対する Proof-of-Concept（POC）エクスプロイトが含まれています。PoC として、プロセスを自動化する Python ファイルがあります。 1. 脆弱性の概要: 脆弱性の対象: Markdown リンク RCE 脆弱性の種類: その他...

CVE-2022-26134

pip3 install -r requirements.txt использование: python3 exp.py url "cmd" пример: python3 exp.py http://192.168.1.1/ whoami...

CVE-2022-24086

CVE-2022-24086 Пример POC для CVE-2022-24086 предоставлено BurpRoot CVE-2022-24086: Обзор Затронутое ПО: Magento2 Идентификатор CVE: CVE-2022-24086 Оценка CVSS: 9.8 Критический Описание CVE-2022-24086 — это критическая уязвимость безопасности, затрагивающая несколько версий платформы электронной...

eval-stdin

Util PHP eval-stdin.phpCVE-2017-9841 취약점은 오래된 eval-stdin.php의 RCE원격 코드 실행 취약점입니다. 이 익스플로잇은 앞서 언급한 취약점을 자동화한 도구일 뿐이며, 아직 개발 중입니다. Ruby 3.0.4로 작성되었으며2시간 이내에 작성, Kali Linux, Arch Linux, Ubuntu minimal 및 Termux에서 테스트되었습니다. 실행 방법: ruby evil-eval.rb 실행한 뒤 help를 입력하면 revshell, checkconnection, privesc 등...

CVE-2025-29017

CVE-2025-29017 - 인터넷 뱅킹 시스템 2.0.0 프로필 사진 업로드를 통한 원격 코드 실행 설명 Code Astro Internet Banking System 2.0.0 에서 pagesviewclient.php의 profilepic 매개변수에 대한 파일 업로드 검증 부재 로 인해 원격 코드 실행RCE 취약점이 존재합니다. 공격자는 업로드 요청을 수정하여 보안 검사를 우회하고 임의 코드 실행 을 유발할 수 있습니다. 영향을 받는 구성 요소 pagesviewclient.php의 profilepic 매개변수 업로드 기능...

redis-stack-CVE-2024-55656

CVE-2024-55656 - Redis Stack - RedisBloom: уязвимость удаленного выполнения кода из-за целочисленного переполнения Название: Redis Stack RedisBloom: уязвимость удаленного выполнения кода из-за целочисленного переполнения ZDI: ZDI-25-009 CVE: CVE-2024-55656 Авторы: rick2600 and gqsilva CVSS: 8.8...

MS15-034

MS15-034 MS15-034 POC "Текущая версия сервера IIS является уязвимой, так как содержит известную уязвимость CVE-2015-1635, MS15-034. Использование этой уязвимости может привести к удаленному выполнению кода или вызову синего экрана смерти. Тестовая команда : wget --header=""Range:...

CVE-2016-6366

CVE-2016-6366 Публичный репозиторий для улучшений эксплойта EXTRABACON — удалённого выполнения кода для Cisco ASA, написанного группой Equation Group NSA и опубликованного Shadow Brokers. Здесь представлены улучшенный шелл-код, скрипт для поиска смещений LINA, модуль Metasploit и extrabacon-2.0. ...