1176633 matches found
EUVD-2026-100990
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...
CVE-2026-108072 Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...
CVE-2026-108072
The TSplus Remote Access software is vulnerable to a flaw caused by incorrect permissions in shared login scripts. Specifically, the autostart1.tscr files in the shared themes directory can be modified by users who lack sufficient privileges. A local attacker with a valid session on the terminal ...
ApacheRCEEssay
CVE-2021-41773 Essay šøļø Description š¼ļø This repository contains an essay about CVE-2021-41773, a remote code execution vulnerability in Apache 2.4.49. This was created for a course from Faculty of Automatic Control and Computers, University POLITEHNICA of Bucharest, namely "Cyberdefences and...
CVE-2026-108071
The TSplus Remote Access software contains an incorrect authentication vulnerability within its multi-factor authentication (MFA) mechanism. A remote attacker who possesses valid first-factor credentials can bypass the second-factor verification because the authentication flow fails to correctly ...
CVE-2026-108071 Improper Multi-Factor Authentication Validation Allows Authentication Bypass
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...
EUVD-2026-100989
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...
CVE-2026-108071 Improper Multi-Factor Authentication Validation Allows Authentication Bypass
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...
CVE-2026-6951
CVE-2026-6951 simple-git Remote Code Execution ā CVE-2026-6951 simple-git --config Option Filter Bypass RCE PoC ā https://github.com/user-attachments/assets/4c992530-c5bb-4ff4-be5d-af0857eebb67 Overview CVE-2026-6951 is a remote code execution vulnerability in simple-git caused by an incomplete f...
CVE-2026-49869
CVE-2026-49869: Kestra Unauthenticated Remote Code Execution ā PoC and Docker lab for the authentication bypass in Kestra OSS AuthenticationFilterā Run this lab only on systems you control. The -p 8080:8080 example may publish the vulnerable API on all host interfaces; block access from other...
CVE-2024-4309-Analysis
š”ļø CVE-2024-4309 Xiaomi HyperOS System Updater ā OTA Signature Verification Bypass & RCE ā ļø EDUCATIONAL PURPOSES ONLY ā Use on real systems is prohibited. š Project Overview / Project Overview Prepared as part of the BGT-Pentest-LAB cybersecurity final project. Xiaomi HyperOS System Updater...
CVE-2026-108070 Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...
CVE-2026-108070 Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...
CVE-2026-108070
The TSplus Remote Access web server is vulnerable to an improper access control flaw. This vulnerability allows an unauthenticated remote attacker to bypass intended access restrictions and reach protected internal resources by using manipulated paths via the /socket.io/JWN/ endpoint. Exploitatio...
EUVD-2026-100980
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...
CVE-2026-40897
CVE-2026-40897 Remote Code Execution in Math.js Expression Parser ā CVE-2026-40897 Remote Code Execution in Math.js PoC ā https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 Overview CVE-2026-40897 is a Sandbox Bypass leading to Remote Code Execution vulnerability in...
CVE-2026-39987-Marimo-Preauth-RCE
CVE-2026-39987 Marimo Pre-auth RCE Research Overview This project focuses on CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability in Marimo related to the terminal WebSocket endpoint /terminal/ws. Marimo is an open-source reactive Python notebook that allows users to write and...
CVE-2021-41773
CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...
CVE-2022-21907
CVE-2022-21907 Description - POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability. - create by antx at 2022-01-17. Detail - HTTP Protocol Stack Remote Code Execution Vulnerability. - Similar to https://github.com/antx-code/CVE-2021-31166CVE-2021-31166. - This problem...
CVE-2026-103905 Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...