CVE-2026-50619 Unauthenticated remote code execution vulnerability

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later...

CVE-2026-50619

A path traversal vulnerability exists in Qsirch , potentially allowing remote attackers to read the contents of unexpected files or system data. The issue is associated with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Remediation is available in Qsirch version 7.0.3.0 an...

EUVD-2026-101991

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later...

CVE-2026-47786 Pre-Authentication Command Injection

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...

CVE-2026-47786

A pre-authentication OS command injection vulnerability (CWE-78) exists in HybridDesk Station , which could allow remote attackers to execute arbitrary commands. The vulnerability is addressed in HybridDesk Station 4.2.23 and 4.3.4 and later versions. No specific exploit code or in-the-wild explo...

EUVD-2026-101989

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...

CVE-2026-39997

The HybridDesk Station application (QNAP HD Station) is vulnerable to an unauthenticated remote input injection caused by a missing authentication for critical function (CWE-306). If successfully exploited, a remote attacker could gain unauthorized access to the system. The vulnerability has been...

CVE-2026-39997 Unauthenticated Remote Input Injection in QNAP HD Station's remotepad

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

EUVD-2026-101988

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

react2shell

React2Shell - CVE-2025-55182 Exploit PoC A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY. ❌ DO NOT use against system...

CVE-2025-68613-poc-via-copilot

✅ CVE-2025-68613 n8n Expression Injection RCE Vulnerability Complete Analysis Date : December 23, 2024 Status : ✅ RCE Fully Verified CVSS Score : 10.0 Critical 🎉 Successful RCE Payload function var require = this.process.mainModule.require; var execSync = require'childprocess'; return execSync'id...

Blackash-CVE-2025-12762

🔐 CVE-2025-12762 — Critical RCE Vulnerability in pgAdmin 4 🚨 What’s the Issue? A Remote Code Execution RCE flaw exists in pgAdmin 4 versions ≤ 9.9. Attackers can run arbitrary commands on the host when pgAdmin is running in server mode and processes a PLAIN-format SQL dump during restore. ⚙️...

CVE-2025-13374

Kalrav AI Agent = 2.3.3 - Unauthenticated Arbitrary File Upload via kalravuploadfile AJAX Action The WordPress Kalrav AI Agent plugin version 2.3.3 and prior contains an arbitrary file upload vulnerability that allows unauthenticated users to upload malicious PHP files to the server, potentially...

EUVD-2026-101983

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later...

PocList

PocList A collection of self-written vulnerability POCs and EXPs. After specifying the URL file, the POC script can perform multi-threaded batch scanning of targets for verification; the EXP script can exploit vulnerabilities, such as file reading, uploading webshells, command execution, etc...

Log4j2-RCE

Log4j2-RCE Log4j2 CVE-2021-44228 Reproduction and Echo Exploit...

Oracle-WebLogic-CVE-2017-10271

WebLogic Wls-wsat XMLDecoder Vulnerability Description mitre:https://vulners.com/cve/CVE-2017-3506 Early on, hackers leveraged the WebLogic WLS component vulnerability to launch large-scale remote attacks against enterprise servers, resulting in a large number of compromised servers. The number o...

nmap-CVE-2022-21907

nmap-CVE-2022-21907 Repository containing nse script for vulnerability CVE-2022-21907. It is a component IIS vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http.sys, which handles most basic IIS operations. After uploading the payload, the...

langflow-CVE-2026-33017-poc

CVE-2026-33017 — Langflow Unauthenticated RCE PoC For educational and authorized testing purposes only. Summary Langflow = 1.8.1 exposes a public flow build endpoint that accepts attacker-controlled flow data containing arbitrary code. This code is passed to prepareglobalscope in validate.py, whi...

pyradm

🔮 pyradm Remote administration crossplatfrom tool via telegram Coded with ❤️ python3 + aiogram3 https://t.me/whlab Screenshots Disclaimer All information contained in this repository is provided for educational and research purposes only The author is not responsible for any illegal use of this...