CVE-2026-101260 Ziroom ZHOME A0101 firstLogin command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-101260

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located within an unknown functionality of the /api/ZRnetwork/firstLogin file, where manipulating the firstLogin argument allows for remote command execution. The vulnerability has a CRITICAL severity rat...

CVE-2026-101260 Ziroom ZHOME A0101 firstLogin command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-71981

PoC de Cypht CVE-2026-71981 Este es un PoC para CVE-2026-71981, una RCE por deserialización insegura. El resultado del comando ejecutado se imprime en la respuesta de la solicitud de cierre de sesión después de las etiquetas . Use --print-all para imprimir también la respuesta completa. Versiones...

cve-2022-27438

CVE-2022-27438 Caphyon Ltd Advanced Installer 19.3 "CustomDetection" 更新检查远程代码执行漏洞。 用法：python3 cve-2022-27438poc.py 详情报告见 gerr.re。 复现步骤 对于其他受影响的产品，你需要更改更新服务器和更新配置文件名。这些通常可以在应用程序安装目录下的更新程序 .ini 文件中找到。 1. 安装 Advanced Installer 19.3； 2. 将 www.advancedinstaller.com 欺骗解析到我们的攻击者 IP； 对于概念验证，最简单的方法是在目标上编辑...

VTIGER-CRM-RCE-CVE-2026-23697

此存储库没有 README。...

EXPLOIT-CVE-2024-7804

CVE-2024-7804 — Deserialización insegura en PyTorch Distributed RPC RCE Laboratorio autocontenido + exploit para CVE-2024-7804 : ejecución remota de código en el framework RPC distribuido de PyTorch torch.distributed.rpc mediante deserialización insegura de datos no confiables CWE-502. Afectado:...

MAL-2026-17236 Malicious code in mini-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e [email protected] presents itself as a pino-like JSON logger, but its main entry exports a middleware factory that, on instantiation, spawns...

MAL-2026-17235 Malicious code in items-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d On require, index.js invokes initializeDaemon at top level, which uses spawn'node', lib/check-items.js, detached: true, stdio: 'ignore' followed by...

Malicious code in items-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d On require, index.js invokes initializeDaemon at top level, which uses spawn'node', lib/check-items.js, detached: true, stdio: 'ignore' followed by...

CVE-2026-102269

A flaw was found in PyJWT. When decoding JSON Web Token JWT signature segments, the library accepts characters outside the standard Base64URL encoding format. A remote attacker can exploit this issue by appending extra characters to a valid token signature, creating an alternate token...

CVE-2026-101205 FastStone Image Viewer PCX Decoder out-of-bounds

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-101205

A vulnerability exists in FastStone Image Viewer up to version 8.3 . The issue resides within an unknown function of the PCX Decoder component, where specific manipulation can trigger an out-of-bounds read . This attack can be initiated remotely . No specific remediation or exploit details are pr...

CVE-2026-101205 FastStone Image Viewer PCX Decoder out-of-bounds

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2025-55182-shellinteractive

CVE-2025-55182-shellinteractive 基础代码源自： https://github.com/Emiyelbarto/CVE-2025-55182-PoC 非常感谢您做出的出色贡献。 概述 CVE-2025-55182 是 Next.js/React Server Components 中的一个反序列化漏洞，允许未经身份验证的远程攻击者在受影响服务器上执行任意代码。该漏洞源于 React Server Actions 对序列化数据的不正确处理。 主要特性： ✅ 交互式 Shell，支持命令历史记录和自动补全 ✅ 自动漏洞检测 ✅ 远程命令执行 ✅ 文件上传/下载功...

CVE-2026-9277

CVE-2026-9277 - Shell-Quote 命令注入漏洞利用 一个专门用于验证和演示 CVE-2026-9277 的概念验证（PoC）漏洞利用脚本——该漏洞是 shell-quote 库旧版本（= 1.8.3）中存在的一个结构性命令注入漏洞。 该扫描器对输入 JSON 载荷执行深度结构操作，通过递归遍历暴露远程代码执行（RCE）向量，并利用动态网络基线计时引擎防止误报。 主要特性 递归 JSON 遍历： 自动检测并变异多层级嵌套 JSON 结构或类 GraphQL 配置中隐藏的目标数组。 组合变异矩阵： 测试高级数组操作场景，包括特定索引插入、绝对列表覆盖以及分散数组对。 自...

CVE-2026-101204 FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

CVE-2026-101204 FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

CVE-2026-101204

A vulnerability exists in FastStone Image Viewer up to version 8.3 within the TGA Image Handler component. Specifically, an unknown function in FSViewer.exe is susceptible to an out-of-bounds read . This flaw can be triggered via a remote attack . While the base severity is rated as Medium , the ...

CVE-2025-47227

CVE-2025-47227 CVE-2025-47227 漏洞利用 - ScriptCase 密码重置（预认证） CVE-2025-47227 是一个 预认证 认证绕过漏洞（CVSS 9.8），影响 ScriptCase Production Environment ≤ 9.12.006。login.php 端点允许在没有令牌、邮件验证或身份验证的情况下重置管理员密码——仅需一个 4 字母 CAPTCHA（轻易可解）和一个包含 nmaction=changepass 的 POST 请求即可。 当与 CVE-2025-47228 （SSH...