CVE-2021-21972

Check CVE-2021-21972 CVE-2021-21972 vCenter-6.5-7.0 RCE POC...

CVE-2022-35914_poc

CVE-2022-35914poc Modified for GLPI Offsec Lab: calluserfunc, arraymap, passthru References Modified to work for Proving Grounds Practice Lab: GLPI https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.p...

CVE-2026-108859

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll befor...

CVE-2026-108860

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

CVE-2024-29050

CVE-2024-29050 CVE-2024-29050 is a security vulnerability in Windows' cryptographic services, particularly in how certificates are processed during cryptographic operations. The issue stems from an integer overflow, which occurs when calculations on data like file sizes or buffer lengths exceed t...

CVE-2026-108681

A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/webchannel.py of the component Web Console. The manipulation of the argument sessionid results in denial of service. The attack may be performed from remote. The exploit h...

CVE-2021-24884

CVE-2021-24884 XSS2RCE in Formidable 4.09.04 Formidable 4.09.04 allowed to inject certain HTML Tags like ,,, and . This could allow an unauthenticated, remote attacker to exploit a HTML-injection by injecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If...

Telerik-UI-ASP.NET-AJAX-Exploitation

Telerik-UI-ASP.NET-AJAX-Exploitation Unrestricted File Upload by Weak Encryption affected versions CVE-2017-11317 2. Remote Code Execution by Insecure Deserialization - CVE-2019-18935...

CVE-2026-108682 zhayujie CowAgent Web Console upload read denial of service

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the publi...

CVE-2026-108682

A denial of service vulnerability exists in zhayujie CowAgent versions up to 2.1.6 . The flaw is located in the Web Console component, specifically within the read function of the /upload file. This weakness allows for remote attack initiation. While an exploit has been made available to the publ...

EUVD-2026-97038

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the publi...

CVE-2022-2274

OpenSSL-src Heap Memory Corruption with RSA Private Key Operation : CVE-2022-2274 Summary OpenSSL-src-rust is a source code and logic to build OpenSSL from source written in rust and packaged as a crate. There are currently two maintained branches, matching the two maintained OpenSSL versions whi...

laforge

Laforge Marco de automatización de infraestructura para competiciones de seguridad Laforge permite el desarrollo rápido de infraestructura para competiciones de seguridad informática. Mediante un lenguaje de configuración simple e intuitivo, Laforge gestiona un grafo de dependencias y el estado d...

CVE-2023-50780

CVE-2023-50780: MBeans peligrosos accesibles a través de la API de Jolokia en Apache ActiveMQ Artemis Al listar e inspeccionar los MBeans expuestos por la API de Jolokia en http://127.0.0.1:8161/console/jolokia se han identificado los siguientes vectores de ataque: Escritura arbitraria de archivo...

CVE-2022-3552

CVE-2022-3552 In order to exploit the vulnerability in BoxBlilling, the version will have to be: "BoxBilling=4.22.1.5" and you will have to have valid admin credentials. If you have the situation above, here are the steps you have to take in order to get the juicy RCE: Create a python virtual...

Blackash-CVE-2025-54574

🛑 CVE-2025-54574 — Heap Buffer Overflow in Squid ≤ 6.3 🛑 Severity: Critical CVSS 9.3 Affected Software: Squid Proxy versions 6.3 and earlier Vulnerability Type: Heap-based buffer overflow Discovered in: URN Uniform Resource Name processing Impact: Possible remote code execution or denial-of-servi...

struts2-jakarta-inject

POC Exploit for CVE-2017-5638 Only use this exploit on systems you own or have explicit rights to test Installation If you have go already installed on your computer, go get is the way to go go get github.com/Greynad/struts2-jakarta-inject Usage Single command execution struts2-jakarta-inject -u ...

CVE-2025-50472

CVE-2025-50472 ModelScope Ms-Swift ModelFileSystemCache Deserialization of Untrusted Data Remote Code Execution Vulnerability RCE PoC I uploaded a code repository containing a malicious .mdl file to ModelScope for testing purposes. It can be used directly during testing. The link is:...

-CVE-2024-45352

🚨 CVE-2024-45352 – Xiaomi Smarthome Remote Code Execution RCE 📌 Summary A critical vulnerability CVE-2024-45352 was discovered in the Xiaomi Smarthome application, allowing unauthenticated remote code execution RCE via improper input handling in the internal API parser. This vulnerability can be...

CVE-2022-24087

CVE-2022-24087-RCE and CVE-2022-24086-RCE CVE description CVE-2022-24086 and CVE-2022-24087 - improper Input Validation vulnerability in contact form Magento Open Source and Adobe Commerce - has received a CVSS score of 9.8 out of 10, it is classified as a pre-authentication issue which means tha...