POC-S

POC-S: POC-T verbesserte Version Die Wiki-Dokumentation von POC-T befindet sich im doc-Verzeichnis Vorwort: Derzeit Rechtlicher Haftungsausschluss Ohne vorherige Zustimmung beider Parteien ist die Verwendung von POC-S zum Angriff auf ein Ziel illegal. POC-S dient ausschließlich...

EUVD-2026-67311

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-76060

An authenticated OS command injection vulnerability in ZoneMinder's event export functionality allows any user with View Events permission to execute arbitrary commands on the server. The exportFile HTTP parameter is passed unsanitized into a shell command executed via PHP's exec() , enabling ful...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

Drupalgeddon2

CVE-2018-7600 | Drupal 8.5.x 8.5.1 / 8.4.x 8.4.6 / 8.x 8.3.9 / 7.x? 7.58 / 6.x? - 'Drupalgeddon2' RCE SA-CORE-2018-002 Drupalggedon2 https://github.com/dreadlocked/Drupalgeddon2/ https://www.drupal.org/sa-core-2018-002 Unterstützt: Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL, Angriff auf...

social_mapper

Social Mapper Questo strumento non è più mantenuto attivamente, parti di esso potrebbero ancora funzionare e accetterò pull request per mantenerlo aggiornato ATTENZIONE: FACEBOOK ORA RILEVA QUESTO DOPO QUALCHE CENTINAIO DI RICERCHE, USA SOLO ACCOUNT FACEBOOK MONOUSO Uno strumento di mappatura dei...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 Inspiriert von https://github.com/dreadlocked/Drupalgeddon2 Unterstützt: Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL, Angriff auf account/mail & postrender Parameter, unter Verwendung der PHP-Funktion...

scan_CVE-2020-29583

Scanner für Zyxel-Produkte, die aufgrund eines undokumentierten Benutzerkontos verwundbar sind CVE-2020-29583 Details zur Schwachstelle: https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html Ich bin mir aber nicht sicher, ob ein Login mit zyfwp über die Web-Oberfläche...

XPKeygen

XPKeygen Windows XP / Windows Server 2003 VLK कुंजी जनरेटर। यह टूल आपको रॉ प्रोडक्ट कुंजी के आधार पर मान्य Windows XP कुंजियाँ उत्पन्न करने की सुविधा देता है, जो यादृच्छिक हो सकती है। रॉ प्रोडक्ट कुंजी RPK 9 अंकों XXX-YYYYYY के रूप में दी जाती है और यह केवल Windows XP कुंजी उत्पन्न करने के लिए...

CVE-2026-54713

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-54687

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

CVE-2026-37004

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-35869

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

BlobRunner

BlobRunner BlobRunner ist ein einfaches Werkzeug, um Shellcode, der während der Malware-Analyse extrahiert wurde, schnell zu debuggen. BlobRunner reserviert Speicher für die Zieldatei und springt zur Basis oder einem Offset des reservierten Speichers. Dies ermöglicht es einem Analysten, mit...

CVE-2026-3844-Lab

CVE-2026-3844 — Breeze Cache: Lab für nicht authentifizierten beliebigen Datei-Upload zu RCE Reines lokales Docker-Lab zur Reproduktion und zum Vergleich des Verhaltens von CVE-2026-3844 im WordPress-Breeze-Cache-Plugin. Dieses Repository demonstriert das verwundbare Verhalten in Breeze Cache 2.4...

CVE-2026-10795-Lab

CVE Lab: CVE-2026-10795 - UpdraftPlus UpdraftCentral RPC Authentication Bypass Chained to Plugin Installation Sommario Esecutivo Questo repository contiene un laboratorio Docker locale per riprodurre e validare CVE-2026-10795, una vulnerabilità di bypass dell'autenticazione non autenticata che...

waybackpack

waybackpack Waybackpack ist ein Befehlszeilenwerkzeug, mit dem Sie das gesamte Wayback-Machine-Archiv für eine bestimmte URL herunterladen können. Zum Beispiel, um jede Kopie der Startseite des Arbeitsministeriums durch das Jahr 1996 herunterzuladen das zufällig das erste Jahr ist, in dem die Sei...