CVE-2026-87482

A flaw was found in chromium-browser. The HttpsUpgrades feature fails to properly enforce encrypted connections, resulting in the cleartext transmission of sensitive data. A remote attacker could exploit this vulnerability by sending crafted network traffic to intercept and expose sensitive...

CVE-2026-87517

A flaw was found in Google Chrome on iOS. A race condition in the mobile browser component allows a remote attacker to bypass the same-origin policy by tricking a user into opening a specially crafted HTML page. Successful exploitation enables unauthorized access to sensitive cross-origin web dat...

CVE-2022-29464

CVE-2022-29464 A preauth arbitrary file upload that leads to RCE in WSO2 Summary of the CVE CVE-2022-29464 is a RCE vulnerability for WSO2 discovered by Orange Tsai. A unauthenticated arbitrary file upload allows an attacker to execute code by uploading a malicious JSP file. Affected Versions WSO...

running-CVE-2024-32002-locally-for-tesing

We are adapting this for local use we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce How It Works 1. A malicious repository gitrce includes a submodule with a specially crafted path. 2. The submodule path uses a case variation that exploits the...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Interactive shell HTTP hijack + POST + AES-256-CBC/BASE64 Detection -dnslog DNSLog No-Output Detection Nuclei -poc Vulnerability Echo Detection Exploitation -exp Interactive shell base64 echo -exp2 Interactive shell HTTP hijack + POST + Base64 -exp3...

CVE-2024-32002

GIT RCE CVE-2024-32002 Description | CVE-2024-32002 | https://www.tarlogic.com/blog/cve-2024-32002-vulnerability-git/ | Exploit | First you need to create "calledrepo" "commandrepo" repos on git. | Victim will later call the calledrepo with "git clone --recursive calledrepo.git" that redirect to...

ActiveMQ-cve-2026-42588-scanner-gui

ActiveMQ-cve-2026-42588-scanner-gui 【VPS 원클릭 익스플로잇 VPS 보유 사용자 추천】 1. VPS 공인 IP와 리스닝 포트를 입력하세요 예: 9999 2. 실행할 명령어를 입력하세요 예: touch /tmp/cvepwned 3. 【VPS 명령 생성】클릭 → 【명령 복사】클릭 4. SSH로 VPS에 로그인하여 명령을 붙여넣고 Enter를 눌러 실행하세요 5. Serving HTTP on 0.0.0.0:9999 메시지가 보이면 서비스가 시작된 것입니다 6. 도구로 돌아와 【익스플로잇 실행】을 클릭하...

CVE-2015-6967

CVE-2015-6967 python exploit.py --url http://xx.xx.xx.xx --username admin --password nibbles --payload phprevshell.php Cambiar $ip en linea 7 de phprevshell.php nc -lvnp 1234...

OTRS-4.0.1-6.0.1-Remote-Command-Execution

OTRS-4.0.1-6.0.1 Remote Command Execution This exploit is developed based on https://www.exploit-db.com/exploits/43853 It will perform the authentication against OTRS panel and provide a reverse shell. Usage: python3 CVE-2017-16921.py CVE-2017-16921: In OTRS 6.0.x up to and including 6.0.1, OTRS...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo...

cachet_2.4.0-dev

CVE-2021-39174 Cachet 2.4.0-dev A python3 script for CVE-2021-39174 Cachet 2.4.0-dev Information Disclosure and RCE via Twig Server Side Template Injection. For the RCE the API KEY for the user is needed. Check out the Leave Songs link below which covers how to get the API KEY via SQL Injection...

DNS-Mayhem-CVE-2026-41096-Deep-Dive

DNS-Mayhem-CVE-2026-41096-Deep-Dive In‑depth technical analysis of CVE‑2026‑41096, a critical heap overflow in Windows DNSAPI.dll enabling remote code execution via crafted DNS responses. Includes attack vectors, patch insights, and defensive guidance for security teams. Overview CVE‑2026‑41096 i...

CVE-2026-101262

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/setonlineclient. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2026-101261

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetupwifi. Executing a manipulation of the argument loginpwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. Th...

CVE-2026-101260

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-24061-POC

CVE-2026-24061 - telnetd 인증 우회 PoC telnetd의 치명적인 인증 우회 취약점으로 인해 root 권한으로 RCE가 가능합니다 2015년부터 취약점이 포함된 telnetd 버전을 사용하는 시스템에 영향을 미칩니다 소개 이 PoC는 11년 동안 탐지되지 않았던 telnetd의 치명적인 인증 우회 취약점인 CVE-2026-24061 을 시연합니다. 이 취약점은 telnetd 로그인 프로세스에서 USER 환경 변수를 부적절하게 처리하는 데서 비롯됩니다. 취약점을 유발한 악명 높은 커밋은 여기에서 확인할 수...

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32-

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32- 사용법 Ncat을 사용한 리버스 셸 리스너 root@Kali:/TryHackme/Ice nc -nlvp 443 listening on any 443 ... connect to 192.168.92.128 from UNKNOWN 192.168.92.133 49211 Microsoft Windows Version 6.1.7601 Copyright c 2009 Microsoft Corporation. All...

CVE-2025-57819

CVE-2025-57819 - FreePBX 인증되지 않은 원격 코드 실행RCE CVE-2025-57819는 Sangoma FreePBX 버전 15, 16, 17 에 영향을 미치는 치명적인 원격 코드 실행RCE 취약점입니다. 이 취약점은 취약한 엔드포인트 내 사용자 제어 입력값의 불충분한 검증sanitization 에서 비롯되며, 인증되지 않은 공격자가 인증을 우회하고, 애플리케이션의 백엔드 데이터베이스를 조작하며, 궁극적으로 기본 서버에서 임의의 운영 체제 명령을 실행할 수 있게 합니다. CVSS v3 기준...

CVE-2026-101264 Ziroom ZHOME A0101 set_passwd command injection

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/setpasswd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-101264

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in an unknown function within the /api/ZRnetwork/set_passwd file, where manipulation of the password1 argument allows for remote execution. The exploit has been publicly disclosed and may be utili...