CVE-2025-55182

CVE-2025-55182 — React2Shell: Advanced Exploit & Master's Thesis Research -brightred Deserialization of Untrusted Data + Prototype Pollution in React Server Components Unauthenticated Remote Code Execution via Next.js Server Actions Affected: React 19.0.0 - 19.2.0 · Patch: React 19.0.1 / 19.1.2 /...

CVE-2022-22965

POC Spring4Shell CVE-2022-22965 Spring4Shell CVE-2022-22965 Proof Of Concept. The naming of this flaw is based on the similarities to the infamous Log4j LOG4Shell. Details about this vulnerability https://websecured.io/blog/624411cf775ad17d72274d16/spring4shell-poc...

PoC-CVE-2026-33017

PoC: CVE-2026-33017 Langflow = 1.8.1 is vulnerable to a remote, unauthenticated RCE https://nvd.nist.gov/vuln/detail/CVE-2026-33017 Usage root@kitploit: usage: CVE-2026-33017.py -h --lhost LHOST --lport LPORT target PoC exploit: CVE-2026-33017 positional arguments: target Target hostname options:...

CVE-2026-0300-POC

🛡️ CVE-2026-0300: Análisis de RCE en el Portal User-ID™ de PAN-OS Prueba de Concepto de Investigación: CWE-787 Escritura Fuera de Límites 📌 Resumen CVE-2026-0300 es una vulnerabilidad de desbordamiento de búfer de alta gravedad identificada en el Portal de Autenticación User-ID™ Portal Cautivo de...

SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis

SharePoint ToolShell CVE-2025-53770 Incident Analysis Overview This project documents the investigation of a real-world exploitation attempt targeting a SharePoint server using the ToolShell vulnerability CVE-2025-53770. The attack demonstrates a full exploitation chain including remote code...

CVE-2026-22812

🔐 CVE-2026-22812 - Servidor HTTP no autenticado de OpenCode → Ejecución Remota de Código RCE Aviso de seguridad, análisis técnico, guía de detección y notas de mitigación para CVE-2026-22812 📌 Resumen CVE-2026-22812 es una vulnerabilidad de Ejecución Remota de Código RCE de alta gravedad que afec...

CVE-2026-21858

🚨 CVE-2026-21858 — «Ni8mare» Una vulnerabilidad crítica de ejecución remota de código no autenticada en una plataforma de automatización de flujos de trabajo de código abierto. 📖 Tabla de Contenidos Descripción general Detalles técnicos Severidad y CVSS Versiones afectadas Impacto Explotación...

CVE-2026-34197

🚨 CVE-2026-34197 — RCE crítica de Jolokia en Apache ActiveMQ RCE autenticada vía MBeans de Jolokia → Spring XML remoto → Ejecución de código en la JVM 📖 Resumen CVE-2026-34197 es una vulnerabilidad de ejecución remota de código autenticada y de alta gravedad que afecta a Apache ActiveMQ Classic. ...

CVE-2026-22241

🚨 CVE-2026-22241 - Open eClass 主题导入远程代码执行 📌 漏洞概述 Open eClass （又称 GUnet eClass）是一个广泛使用的开源学习管理系统（LMS），其主题导入 功能中存在一个严重的不受限制的文件上传 漏洞。 经过身份验证的管理员可以上传恶意 ZIP 文件，从而导致在服务器上远程执行代码（RCE） 。 ⚠️ 受影响版本 版本| 状态 ---|--- Open eClass 4.2| 受影响 Open eClass ≥ 4.2| 已修复 🛠️ 漏洞详情 CVE ID ：CVE-2026-22241 严重性 ：高危（CVSS 7.3） 类型...

CVE-2002-1120

🐞 CVE-2002-1120: Savant Web Server 3.1 - Stack-Based Buffer Overflow Egghunter Classic stack-based buffer overflow in Savant Web Server 3.1 demonstrating early-2000s remote memory corruption through a crafted HTTP request a 2002 vulnerability that demands more from a beginner than most buffer...

CVE-2026-28289

🚨 CVE-2026-28289 — “Mail2Shell” 通过邮件附件绕过实现 FreeScout 零点击未授权 RCE 📖 概述 CVE-2026-28289 ，别名为 Mail2Shell ，是一个影响 FreeScout 的严重零点击远程代码执行（RCE）漏洞。 攻击者可以向 FreeScout 邮箱发送一封特制邮件，从而在无需身份验证、无需用户交互的情况下获得底层服务器的远程 shell 访问权限 。 🧠 漏洞摘要 字段| 值 ---|--- CVE ID| CVE-2026-28289 严重程度| 🔴 严重 CVSS| 10.0（最高） 攻击向量| 远程（邮件）...

oxasploits

oxasploits 由 oxagast 编写的一系列漏洞利用工具 大部分这些 CVE 也归属于 oxagast 联系方式：Marshall Whittaker [email protected] CVE 和 PoC 代码 CVE-2006-3392 Webmin =1.29 远程 root 漏洞利用 该漏洞利用通过目录遍历和任意读取漏洞窃取 Webmin cookie，然后复用该 cookie 来利用一个已认证用户漏洞，从而实现远程获取 root 权限。 CVE-2010-2626 针对 Miyabi CGI Tools =1.02 和 iOffice 0.1 的 Perl...

cve-2025-59287-exploit-poc

CVE-2025-59287 概念验证漏洞利用 漏洞概述 CVE-2025-59287 是 Microsoft Windows Server Update Services WSUS 中的一个严重远程代码执行 RCE 漏洞。该漏洞是由于 EncryptionHelper.DecryptData 方法中通过 BinaryFormatter 对 AuthorizationCookie 数据进行不安全反序列化所致。 影响 ：未认证攻击者可通过向 GetCookie 端点发送恶意加密 Cookie，以 SYSTEM 权限 实现远程代码执行。 CVSS 评分 ：严重（9.8） 漏洞详情 受影响组件...

CVE-2024-31666

Vulnerability Overview A vulnerability exists in Flusity-CMS v.2.33 that allows a remote attacker to execute arbitrary code via a crafted script in the editaddonpost.php component. Affected Versions Flusity-CMS v.2.33 Vulnerability Details An attacker can exploit this vulnerability by sending a...

PT-2026-85286

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description Multiple buffer overflow issues exist in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched...

PT-2026-85266

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX55 v4 versions prior to 1.2.1 Build 20260527 Description A stack-based buffer overflow exists in the EasyMesh module. When Mesh mode is enabled, a LAN attacker can submit crafted input to the EasyMesh daemon, which may cause t...

PT-2026-85205

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoi...

Next.js Framework 15.5.x < 15.5.21 / 16.x < 16.2.11 Image Optimization API DoS (GHSA-q8wf-6r8g-63ch)

The Next.js Framework on the remote host is affected by a denial of service vulnerability: - When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, the...

PT-2026-85288

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description A remote code execution issue exists in the SplitHandler::handlePreCheckSplitDir function of alogsplit. The software fails to sanitize shell metacharacters within log file pathnames, allowing...

PT-2026-85001

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 Description An expression sandbox escape exists in the $fromAI handler. The $fromAI handler resolved caller-supplied placeholder names without verifying i...