DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. id: CVE-2018-15811 info: name: DotNetNuke...

Apache Tika < 1.1.8 - Header Command Injection

Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. i...

MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database RDB version 2.0.0.1 and earlier contain...

Netsweeper <=6.4.3 - Python Code Injection

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters. id: CVE-2020-13167 info: name: Netsweeper =6.4.4 to mitiga...

Kramer VIAware - Privilege Escalation and Remote Code Execution

Kramer VIAware, all tested versions, allow privilege escalation and remote code execution due to misconfigured sudo permissions. Attackers can execute arbitrary system commands remotely if the web interface is accessible, due to vulnerabilities in the handling of privileged operations through...

Apache Tomcat Path Equivalence - Remote Code Execution

Path Equivalence- 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. id: CVE-2025-24813 info: name: Apache Tomcat Path Equivalence - Remote Code Execution...

SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution

SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the systemlog.cgi page. id: CVE-2020-17456 info: name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution author: gy741,edoardottt severity: critical description: SEOWON INTECH...

Micro Focus UCMDB - Remote Code Execution

Micro Focus UCMDB is susceptible to remote code execution. Impacted products include Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions, and Operations Bridge containerized 2020.05, 2019.08, 2019.0...

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

Gitea <= 1.27.0 - Pre-Auth Remote Code Execution

Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GITDIR. An attacker with write access can execute arbitrary commands as the Gitea service account...

DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code. id: CVE-2018-7700 info: name: DedeCMS 5.7SP2 - Cross-Site...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution

JetBrains TeamCity 2026.1.3, 2025.11.7 contains a remote code execution caused by unauthenticated access via the agent polling protocol, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication. id: CVE-2026-63077 info: name: JetBrains TeamCity 2026.1....

LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

CVE-2026-29041

CVE-2026-29041 — RCE authentifiée via téléchargement de fichier sans restriction dans Chamilo LMS 1.11.32 -yellow?style=for-the-badge Exécution de code à distance authentifiée dans Chamilo LMS 1.11.32 via une validation inadéquate du téléchargement de fichiers dans le point de terminaison AJAX...

CVE-2026-33229

CVE-2026-33229 — RCE dans XWiki via contournement du sandbox Apache Velocity Une vulnérabilité d'exécution de code à distance dans XWiki Platform qui permet à un utilisateur authentifié disposant des permissions de script de contourner entièrement le sandbox Apache Velocity — sans nécessiter de...

CVE-2025-49844-Vulnerability-Scanner

Scanner de vulnérabilité CVE-2025-49844 RediShell Un scanner de vulnérabilité complet pour tester les instances Redis contre la vulnérabilité critique CVE-2025-49844 RediShell. À propos de la vulnérabilité ID CVE : CVE-2025-49844 Nom : RediShell Score CVSS : 10,0 Critique Type : Use-After-Free UA...

CVE-2026-20180

Cisco ISE RCE : Analyse Avancée de l'Exploitation et de la Remédiation 📋 Table des Matières 1. Résumé Exécutif 2. Analyse de la Surface d'Attaque 3. Vecteurs d'Exploitation 4. Techniques d'Évasion Avancées 5. Impact Systémique sur les Architectures Zero Trust 6. Stratégie de Remédiation 7...

CVE-2026-22812

CVE-2026-22812 Vue d'ensemble Un outil d'exploitation en Python pour la vulnérabilité d'exécution de code à distance RCE d'OpenCode affectant les versions v1.0.216. Cet outil fournit plusieurs vecteurs d'attaque, notamment l'exécution de commandes, la lecture/écriture de fichiers, le...

CVE-2026-25253-research

Preuve de concept CVE-2026-25253 Exécution de code à distance RCE en un clic sur OpenClaw via détournement de WebSocket inter-site Cross-Site WebSocket Hijacking. AVERTISSEMENT : Ce code est fourni uniquement à des fins de recherche en sécurité autorisée et à des fins éducatives. L'utilisation de...