EUVD-2026-64920

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-78416

Craft CMS versions 4.0.0-RC1 through 4.18.1 and 5.0.0-RC1 through 5.10.5 are affected by an authenticated remote code execution vulnerability in the control panel element-search condition handling. The root cause is a JSON cleanse bypass in condition.config that allows Yii behavior/event configur...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

EUVD-2026-64918

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364 Awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2016-10033

CVE-2016-10033 Questa vulnerabilità colpisce PHPMailer 5.2.18 ed è in grado di ottenere l'esecuzione di codice remoto. Risorse https://vulners.com/cve/CVE-2016-10033 Utilizzo Essendo scritto in Golang, puoi compilare l'exploit da solo, purché Golang sia installato nel tuo sistema con:...

n8n-RCE

n8n RCE CORRETTO Esecuzione di codice da remoto tramite flussi di lavoro n8n Basato su CVE-2025-68613 ⚠️ Realizzato solo a scopo educativo 📚 Installazione e Utilizzo 🛠️ root@kitploit: $ git clone https://github.com/AbdulRKB/n8n-RCE.git $ cd n8n-RCE $ pip install -r requirements.txt $ python...

Security Bulletin: Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

Summary Langflow contains multiple vulnerabilities that allow arbitrary Python and operating system command execution on the server. The PythonFunction component lacks the runtime code-execution gate applied to other code-execution components, enabling an authenticated user to bypass the...

CVE-2024-23346

🚀 CVE-2024-23346 Chemistry - HTB Questo repository contiene un file di informazioni cristallografiche CIF destinato all'uso sulla macchina "Chemistry" su Hack The Box HTB. Esempio di file CIF root@kitploit: dataExample celllengtha 10.00000 celllengthb 10.00000 celllengthc 10.00000 cellanglealpha...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Dentro lo Zero-Day di Adobe AEM-Forms — Cosa devono fare Pentesters e Difensori TL;DR: Adobe Experience Manager AEM Forms su JEE ≤ 6.5.23.0 conteneva una critica falla accessibile in rete CVE-2025-54253 che consente l'esecuzione remota di codice non autenticata tramite endpoint...

React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell CVE-2025-55182: Il bug di deserializzazione che ha rotto il Web ⚡ React2Shell, CVE-2025-55182, Vulnerabilità RCE: Un'analisi critica del difetto di deserializzazione non sicura nei React Server Components che consente l'esecuzione di codice remoto non autenticata su installazioni...

CVE-2011-2523-poc

CVE-2011-2523-poc Questo è uno script Python3 per sfruttare la vulnerabilità CVE-2011-2523, l'Esecuzione di Comandi Backdoor di VSFTPD 2.3.4, utilizzando i moduli socket e telnetlib. Requisiti root@kitploit: sudo python3 -m pip install pwntools Installazione root@kitploit: git clone...

CVE-2026-63639

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If...

CVE-2025-10585-The-Chrome-V8-Zero-Day

CVE-2025-10585: Der Chrome V8 Zero-Day, den Sie heute patchen müssen ⚔️🛡️ Google hat diese Woche einen außerplanmäßigen Patch für CVE-2025-10585 veröffentlicht, eine schwerwiegende Type-Confusion -Sicherheitslücke in Chrome's V8 JavaScript/WebAssembly-Engine. Der Fehler ist nicht theoretisch –...

CVE-2022-21587-Oracle-EBS-

Prerequisiti per eseguire questo exploit: python3 con i moduli inclusi requests, os, sys, slipit uuencode Prima di eseguirlo, assicurati di usarlo solo per scopi etici Se l'esecuzione dell'exploit fallisce: Assicurati di aver già installato i moduli prerequisiti installa requests pip3 install...

CVE-2020-35846

Cockpit CMS NoSQL Injection to Esecuzione Remota di Codice : CVE-2020-35846 Descrizione Cockpit CMS presenta alcune vulnerabilità NoSQL che possono essere utilizzate per scaricare le informazioni degli utenti. Queste fughe di informazioni possono essere concatenate per modificare le password degl...

CVE-2026-62291

A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image formats. A remote attacker could exploit this vulnerability by providing a specially crafted image sequence with mismatched auxiliary alpha dimensions. During the image processing workflow, this could lead to...

exploit-CVE-2022-24780

iTop RCE via SSTI - CVE-2022-24780 Exploit iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

CVE-2022-36553-PoC

CVE-2022-36553 - Hytec Inter HWL-2511-SS Nicht authentifizierte Remote-Befehlseinschleusung. Übersicht Dieses Repository enthält ein Proof-of-Concept PoC Reverse-Shell-Skript zur Ausnutzung von CVE-2022-36553, einer kritischen Schwachstelle in Hytec Inter HWL-2511-SS-Geräten. Das Skript ist eine...