CVE-2026-82971 QVidium Opera11 CGI Script net_tr.cgi command injection

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...

CVE-2026-82957 hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...

React4Shell

React2Shell Exploit Prueba de concepto PoC para la vulnerabilidad de ejecución remota de código en React Server Components RSC / Next.js. Descripción Existe una vulnerabilidad de ejecución remota de código sin autenticación previa en React Server Components versiones 19.0.0, 19.1.0, 19.1.1 y...

CVE-2026-35333

CVE-2026-35333 strongSwan RADIUS attribute-iterator bucle infinito pre-autenticación / DoS remoto. Descripción attributeenumerate en src/libradius/radiusmessage.c:247-271 acepta atributos RADIUS cuyo byte length es menor que sizeofrattrt 2. Para length == 0: data-len = next-length - sizeofrattrt...

CVE-2024-5084-Red-Team

🚀 HashForm Exploit – Demo de Laboratorio Este repositorio contiene un exploit de prueba de concepto para CVE-2024-5084, una vulnerabilidad encontrada en el plugin Hash Form de WordPress. Está destinado únicamente para aprendizaje, pruebas en laboratorio e investigación de seguridad. 📌 Acerca de l...

CVE-2026-82954 Dokploy Settings application.ts writeTraefikConfigInPath path traversal

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched...

CVE-2026-82954

CVE-2026-82954 is a remote path traversal vulnerability in Dokploy (up to version 0.29.7), specifically in the writeTraefikConfigInPath function within the file packages/server/src/utils/traefik/application.ts of the Settings component. Manipulation of the path argument allows an attacker with lo...

wp2shell-rce

WP2Shell RCE 単一エンドポイントまたは大規模なターゲットリストに対して、WordPress Core インストールにおける WP2Shell エクスプロイトチェーンへの曝露を検出するために設計された、評価・スキャンユーティリティです。 ⚠️ 免責事項 所有しているシステム、または評価を許可されたシステムのみをスキャンしてください。 許可なく第三者のシステムをスキャンまたはテストすることは違法です。メンテナは、本ユーティリティの不正使用または副次的な損害について、一切の責任を負いません。 脆弱性の概要 WP2Shell は、プラグインの依存関係や認証を必要とせず、デフォルトの...

CVE-2026-82922 ShopEx ECShop flow.php flow_update_cart sql injection

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flowupdatecart of the file /flow.php?step=updatecart. The manipulation of the argument recid leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...

CVE-2026-82922

ShopEx ECShop versions up to 2.5.1 are affected by a remote SQL injection in the function flow_update_cart within the file /flow.php?step=update_cart. The vulnerability is triggered by manipulating the rec_id argument, allowing an unauthenticated attacker to inject SQL over the network with no us...

CVE-2026-82919

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function createapp of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

CVE-2026-82906

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-82909

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82914

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-81891

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

CVE-2026-82921

ShopEx ECShop up to 2.5.1 is affected by an unrestricted file upload vulnerability in the check_img_type function within admin/pack.php . Manipulating the pack_img argument allows a remote attacker with no privileges and no user interaction to upload arbitrary files. The vulnerability is rated CV...

CVE-2026-82921 ShopEx ECShop pack.php check_img_type unrestricted upload

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function checkimgtype of the file admin/pack.php. Executing a manipulation of the argument packimg can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to th...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina Info : New Microsoft Office zero-day used in attacks to execute PowerShell Summary On the 29th of May 2022, the NaoSec team, an independent Cyber Security Research Team, discovered a malicious Office document shared on Virustotal. This...

CVE-2025-55182-React2shell

CVE-2025-55182 - React2shell Un exploit en Python 2.7 para CVE-2025-55182 – una vulnerabilidad crítica de contaminación de prototipos / RCE en aplicaciones Next.js. Esta herramienta permite tanto shell interactivo para un solo objetivo como escaneo masivo de múltiples hosts con subprocesos...

CVE-2026-82919

A missing authentication vulnerability was identified in cu silicon up to version 0.1.5 , affecting the create_app function in views.py within the edit Endpoint component. A remote attacker with no prior authentication can exploit this flaw, resulting in low impact on confidentiality, integrity, ...