WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Muhammad Sobirov in WordPress Plugin Everest Backup versions = 2.3.13...

CVE-2026-105776 bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admintransaction.php. This manipulation of the argument Username causes sql...

CVE-2026-105776

A SQL injection vulnerability exists in the bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL web application. The flaw is located in an unknown functionality of the /admin_transaction.php file, where manipulation of the Username argument allows for remote code execution via S...

CVE-2026-105776 bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admintransaction.php. This manipulation of the argument Username causes sql...

EUVD-2026-92963

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admintransaction.php. This manipulation of the argument Username causes sql...

CVE-2026-105776 bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admintransaction.php. This manipulation of the argument Username causes sql...

Savannah lwIP SMTP client

ADVISORY SUMMARY Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability...

CVE-2026-63030

🚨 CVE-2026-63030 — WP2Shell Confusión de rutas en la API REST de WordPress → Ejecución remota de código Una vulnerabilidad crítica del núcleo de WordPress que permite la confusión de rutas en la API REST y que puede encadenarse con inyección SQL para lograr ejecución remota de código sin...

CVE-2025-32583

🚨 CVE-2025-32583 — Exploit RCE para WordPress PDF 2 Post Vulnerabilidad CRÍTICA CVE-ID: CVE-2025-32583 Severidad: 9.9 CRÍTICA Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Descripción Una vulnerabilidad en el plugin PDF 2 Post de WordPress desarrollado por termel permite la Inclusió...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update 越权访问漏洞 Broken Access Control LiteLLM 的 /config/update 端点未检查调用者的角色权限 。任何持有有效 API Key 的已认证用户（无需管理员权限）均可修改代理配置，注册恶意 Pass-Through 端点以实现 环境变量窃取、任意文件读取、远程代码执行 等攻击。 Field| Value ---|--- CVE| CVE-2026-35029 CVSS v4.0| 8.7 HIGH —...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE 在分析此漏洞时，我发现 MCPJam Inspector 将 /api/mcp/connect 端点绑定到 0.0.0.0，从而暴露在网络中。该端点接受一个包含 serverConfig 的 JSON 对象，其中包含 command 和 args 字段。 该应用旨在启动 MCP 服务器，但未能正确处理用户提供的值。因此，攻击者可以发送包含任意命令和参数的构造 HTTP 请求，这些请求随后会在服务器上执行，导致远程代码执行 RCE。 最有趣的是，漏洞利用载荷并非任意构造。通过使用 Burp Suite...

CVE-2026-46817

🚨 CVE-2026-46817 - 关键远程代码执行 Oracle E-Business Suite – Oracle Payments（文件传输） 影响Oracle Payments（文件传输）的关键未认证远程漏洞，可能通过HTTP完全攻破该应用。 📌 概述 CVE-2026-46817 是 Oracle E-Business Suite 中 Oracle Payments 组件的一个 关键 漏洞。该缺陷影响 文件传输 功能，可通过 HTTP 远程利用，无需认证 。 成功利用后，攻击者可完全攻破易受攻击的 Oracle Payments 应用，导致以下全部损失： 🔓 保密性 ✏️ 完整...

CVE-2025-52970

CVE-2025-52970 FortiWeb 认证绕过到远程代码执行漏洞利用程序 功能特性 武器化：添加交互式 Shell 实现远程代码执行 使用方法 python CVE-2025-52970.py -t target.com 演示 参考来源 https://github.com/Hex00-0x4/FortiWeb-CVE-2025-52970-Authentication-Bypass 免责声明 此概念验证代码仅用于教育目的，本人不对任何恶意使用负责。...

CVE-2026-105775 vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds

A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function convssmforward of the file vllm/modelexecutor/layers/mamba/mambamixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to b...

EUVD-2026-92962

A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function convssmforward of the file vllm/modelexecutor/layers/mamba/mambamixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to b...

CVE-2026-105775

A security vulnerability exists in vllm-project vLLM up to version 0.31.0 . The issue resides within the Completions Request Handler component, specifically affecting the conv_ssm_forward function in the file vllm/model_executor/layers/mamba/mamba_mixer2.py . This flaw allows for an out-of-bounds...

CVE-2026-105775 vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds

A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function convssmforward of the file vllm/modelexecutor/layers/mamba/mambamixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to b...

FUXAPWN

CVE-2026-25895 — FUXA = 1.2.9 Path Traversal no autenticado a Ejecución Remota de Código Escritura arbitraria de archivos no autenticada pre-auth contra FUXA, una plataforma SCADA/HMI basada en Node.js. Encadena a ejecución remota de código mediante varias primitivas posteriores a la escritura...

react2shell-CVE-2025-55182-full-rce-script

Next.js React2Shell CVE-2025-55182 Herramienta de Explotación Una herramienta de prueba de concepto para demostrar la vulnerabilidad crítica React2Shell CVE-2025-55182 / CVE-2025-66478 únicamente en entornos de prueba locales autorizados. ⚠️ ADVERTENCIA CRÍTICA: EXPLOTACIÓN ACTIVA Esta...

WSUS-CVE-2025-59287-RCE

WSUS-CVE-2025-59287-RCE CVE-2025-59287 es una vulnerabilidad de ejecución remota de código crítica CVSS 9.8 que afecta a TODOS los Microsoft Windows Server Update Services, también conocidos como WSUS, y ha sido explotada en ataques reales. La vulnerabilidad explota una deserialización insegura e...