CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-41089

🚨 CVE-2026-41089 - Exécution de code à distance RCE critique via Netlogon Windows ⚠️ Une vulnérabilité critique du service Netlogon Windows permettant une exécution de code à distance non authentifiée sur les contrôleurs de domaine. 📖 Présentation CVE-2026-41089 est une vulnérabilité critique...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE Эта PoC демонстрирует, как злоумышленник может объединить Orange Tsai's CVE-2024-4577 с DNS-ребндингом для достижения удаленного выполнения кода на внутренней сетевой инфраструктуре непосредственно через веб-браузер жертвы. Обходя Same-Origin Policy SOP и эксплуатируя уязвимы...

KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x — Эксплуатация аутентифицированного удаленного выполнения кода ⚠️ ТОЛЬКО ДЛЯ АВТОРИЗОВАННОГО ТЕСТИРОВАНИЯ БЕЗОПАСНОСТИ — несанкционированное использование незаконно и неэтично. 📋 Обзор Этот эксплойт демонстрирует критическую уязвимость аутентифицированного удаленного выполнения...

CVE-2025-6514

mcp-remote 로컬stdio 서버만 지원하는 MCP 클라이언트를 인증 지원과 함께 원격 MCP 서버에 연결해 주는 도구입니다: 참고: 이것은 동작하는 개념 증명proof-of-concept 이므로 실험적 으로 간주해야 합니다. 왜 필요한가? 지금까지 대부분의 MCP 서버는 stdio 전송 방식을 사용하여 로컬에 설치되었습니다. 여기에는 몇 가지 장점이 있습니다. 클라이언트와 서버 모두 사용자가 실행 권한을 부여했기 때문에 서로를 암묵적으로 신뢰할 수 있습니다. API 키와 같은 비밀 정보는 환경 변수를 사용하여 추가할 수...

CVE-2024-28397

CVE-2024-28397 Эксплуатация обхода песочницы js2py - CodePartTwo - HTB Код эксплойта на Python для CVE-2024-28397 , критической уязвимости в js2py = 0.74, позволяющей обход песочницы и удаленное выполнение кода. 🚨 Детали уязвимости CVE ID : CVE-2024-28397 Затронутое ПО : js2py = 0.74 Серьезность ...

CVE-2021-31630

CVE-2021-31630 OpenPLC 3 웹서버 인증된 원격 코드 실행. 설명 Open PLC Webserver v3에 명령 삽입 취약점이 존재하여 원격 공격자가 임의 코드를 실행할 수 있습니다. HTB Wifinetictwo.htb 머신에서만 테스트되었습니다. 취약점을 익스플로잇하는 모든 스크립트에서 문제를 발견했습니다. 아마도 제가 파럿Parrot을 사용하거나 제 브라우저 때문일 수 있습니다. 크롬은 로그인에 작동하지만, 파이어폭스에서는 로그인 문제가 있었고 웹 서버에 POST 요청으로 로그인할 때 이상한 현상이...

CVE-2026-105486

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-105484

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

CVE-2026-105487

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105571

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...

CVE-2025-69219

CVE-2025-69219 — Exécution de code à distance RCE via désérialisation Pickle non sécurisée dans Apache Airflow Providers HTTP Sévérité : Élevée CVSS 3.1 : 8.8 Vecteur : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE : CWE-913 — Contrôle inadéquat des ressources de code gérées dynamiquement Versions...

CVE-2021-21974

CVE-2021-21974 PoC d'exécution de code à distance par débordement de tas OpenSLP dans VMware ESXi Auteur : Aiyakami Aperçu CVE-2021-21974 est une vulnérabilité de débordement de tas dans le service OpenSLP de VMware ESXi. Un attaquant non authentifié peut envoyer des paquets spécialement conçus a...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

CAREL Boss Mini <= 1.4.0 - Local File Inclusion

Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access. id: CVE-2023-3643 info: name: CAREL Boss Mini = 1.4.0 - Local File Inclusion author:...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware Web Services versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic...

gogs-CVE-2025-8110

Preuve de concept PoC pour CVE-2025-8110 - Gogs Ce dépôt contient une preuve de concept PoC pour CVE-2025-8110, une vulnérabilité d'exécution de code à distance RCE dans Gogs. L'exploit cible l'implémentation du serveur SSH interne, permettant aux attaquants d'injecter des commandes malveillantes...

CVE-2026-20253

Splunk Enterprise — учебная лаборатория CVE-2026-20253 Splunk Enterprise 10.2.3 · PostgreSQL recovery sidecar · CWE-306 Отсутствие аутентификации для критической функции Авторизованная автономная репродукция, которая моделирует реальный бюллетень безопасности для обучения защите. Она не содержит...