CVE-2026-102616 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

EUVD-2026-89335

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616

A SQL injection vulnerability exists in risesoft-y9 WorkFlow-Engine up to version 9.6.10 . The flaw is located within the getByIdAndYear function of the CustomHistoricProcessServiceImpl.java file in the OAuth2 Resource Filter component. By manipulating the year/processInstanceId arguments, an att...

CVE-2026-95345

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the restricted sandbox environment by enticing a user to open a specially crafted HTML page. The issue is caused by a use-after-free condition in the Actor component, where...

CVE-2026-79657

A flaw was found in NLTK. This vulnerability allows a remote attacker to achieve arbitrary code execution by supplying a specially crafted model or tokenizer artifact for the application to process. The issue occurs because the deserialization allowlist mechanism permits entire software namespace...

CVE-2017-8046

DISCLAIMER: This repository is supplementary to the VGS blog post, How to Avoid "Using Components with Known Vulnerabilities". It contains an application with a known security vulnerability namely, CVE-2017-8046, as well as the description of how to exploit it. Use the application at your own ris...

CVE-2026-102825 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...

CVE-2026-102825

The Russh Rust SSH client and server library versions prior to 0.62.6 are vulnerable to a logic error in the USERAUTH_REQUEST runtime path (specifically within russh/src/server/encrypted.rs). The library increments the authentication attempt counter but fails to compare it against the server::Con...

CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v4.0 Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other...

CVE-2025-4389

CVE-2025-4389 Exploit Details Published : May 16, 2025 Updated : May 17, 2025 Severity : Critical CVSS Score: 9.8 CWE : CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type Affected Versions : All versions from n/a through 2.6.8.1 Researcher :...

nuclei-template-cve-2025-31324-check

SAP CVE-2025-31324 Check Overview This template is designed to check the presence of the SAP NetWeaver CVE-2025-31324 vulnerability. This vulnerability allows unauthorized users to upload JSP files through the /developmentserver/metadatauploader endpoint, which can lead to potential remote code...

Go-Get-RCE-CVE-2018-6574-POC

CVE-2018-6574 POC LINK https://nvd.nist.gov/vuln/detail/CVE-2018-6574 http://blog.nsfocus.net/cve-2018-6574/ RUN go get github.com/neargle/CVE-2018-6574-POC DETAIL payload at: https://github.com/neargle/CVE-2018-6574-POC/blob/master/calc.cL10 Now it supports all platforms using CGO features. Afte...

CVE-2026-95353

A flaw was found in chromium-browser. A use-after-free vulnerability in the browser bindings allows a remote attacker to achieve arbitrary code execution within the sandbox environment by convincing a user to open a specially crafted HTML page. Successful exploitation occurs when the application...

EUVD-2026-71636

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol...

CVE-2026-102821 Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

CVE-2026-23918-poc

CVE-2026-23918 — Apache modhttp2 Double Free Affected: Apache HTTP Server 2.4.66 with modhttp2 + Event MPM Fixed in: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 HIGH — Unauthenticated Remote Code Execution possible CWE: CWE-415 Double Free What's the vulnerability modhttp2 in Apache 2.4.66 has a...

detect-CVE-2019-15107-by-pyshark

detect-CVE-2019-15107-by-pyshark I. Overview of CVE-2019-15107 Webmin is a web-based interface for system administration for Unix. Using any web browser, you can set up user accounts, Apache, DNS, file sharing, and more. On August 10, 2019, Turkish cybersecurity researcher Özkan Mustafa Akkuş...

Exploit-PoC-CVE-2021-40444-inject-ma-doc-vao-docx

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

CVE-2025-57819-exploit

CVE-2025-57819 — FreePBX Pre-Auth SQLi to RCE An all-in-one exploit for CVE-2025-57819 , an unauthenticated SQL injection in FreePBX's endpoint module that leads to remote code execution via cron job injection. CVSS : 9.8 Critical — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA KEV : Added...