EUVD-2026-85619

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...

EUVD-2026-85618

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87900

An argument injection vulnerability exists in the WP Toolkit for cPanel version 6.11.2-10794 and earlier. This flaw allows a remote authenticated user to perform database modifications in other accounts, which can include reading arbitrary files and executing arbitrary code across customer accoun...

CVE-2026-87899

A critical flaw in the CalDAV and CardDAV services of cPanel & WHM version 120 and later allows an authenticated account holder to execute arbitrary code with root privileges , potentially leading to full server control. This vulnerability is triggered by the execution of commands with unnecessar...

CVE-2024-57376

CVE-2024-57376 Exploit de ejecución remota de código sin autenticación para D-Link DSR-250 y DSR-250N Aviso de seguridad: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 Uso root@kitploit: $ python3 exploit.py usage: Ejemplo root@kitploit: $ python3 exploit.py...

CVE-2026-96551 sfturing hosp_order CommonUserController.java cross-site request forgery

A vulnerability was determined in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be...

CVE-2026-96551

A vulnerability exists in sfturing hosp_order (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) involving an unknown function within the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. This flaw allows for a cross-site request forgery (CSRF) attack that can be launched...

EUVD-2026-85617

A vulnerability was determined in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be...

log4j-cve-2021-44228-sample

Ejemplo de exploit de log4j Este repositorio contiene una muestra funcional del abuso del reciente exploit de log4j. No realiza una ejecución remota de código real, pero te muestra la facilidad con la que un actor malintencionado puede hacer que una aplicación vulnerable llame a su propio servido...

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

EUVD-2026-85609

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

CVE-2026-85475 Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...

CVE-2026-85475 Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...

aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 Description : allows remote authenticated users to execute arbitrary commands via the setting menu of Sotfware Store. Affected version : All = 6.6.6 Information To make this PoC, I just installed the software using docker-compose Vulnerability Type : Remote...

CVE-2022-29806

CVE-2022-29806 ZoneMinder hasta 1.36.12 Escalada de privilegios de idioma y RCE Descripción Una vulnerabilidad de Path Traversal en el archivo de registro de depuración y la opción de idioma predeterminado en ZoneMinder versiones anteriores a 1.36.13 y 1.37.11 permite a los atacantes escribir y...

omigod-lab

Readme An educational lab VM to learn about the 9.6 CVSS unauthenticated Remote Code Execution RCE vulnerability in Open Management Infrastructure software CVE-2021-38647. Disclosure original research: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure OMI source code:...

CVE-2022-30190

CVE-2022-30190 - Microsoft Support Diagnostic Tool Acerca de Este script intentará crear un documento de Microsoft Office que ejecutará código de forma remota. Configuración root@kitploit: git clone https://github.com/joshuavanderpoll/CVE-2022-30190.git cd CVE-2022-30190 python3 CVE-2022-30190.py...

CVE-2026-96550

A vulnerability exists in sfturing hosp_order (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8 ) involving the getProperties function in ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. This flaw allows for the cleartext transmission of sensitive information via remote manipulation. A...

EUVD-2026-85640

A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssmpro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The...

Issabel-PBX-4.0.0-RCE-Authenticated

Issabel PBX 4.0.0 Ejecución Remota de Código Autenticado - CVE-2024-0986 Descripción/Resumen Issabel PBX 4.0.0 permite a un usuario autenticado usar la consola asteriskcli para crear archivos con los comandos xmldoc y dump. Esto permite ejecutar comandos remotos basados en el nombre de los archiv...