sendmail-clamav-exploit-CVE-2007-4560

Sendmail + ClamAV-Milter 利用工具 CVE-2007-4560 Python RCE 利用工具，针对 Sendmail 搭配 ClamAV-Milter 0.91.2 CVE-2007-4560。通过 SMTP RCPT TO 标头实现远程 root 命令注入。 关于 经典 Sendmail/ClamAV-Milter 远程 root 利用工具的 Python 移植版，原始 Perl 版本由 Eliteboy 编写。 原始利用工具：exploit-db.com/exploits/4761 漏洞详情 该利用工具利用了 clamav-milter 0.91.2...

cpanel-pwn

cpanel-pwn cPanel/WHM security testing toolkit. Implements the CVE-2026-41940 CRLF injection authentication bypass and post-exploitation privilege pivoting. Tools Script| Purpose ---|--- cpanelexploit.py| CVE-2026-41940: CRLF injection → WHM auth bypass → root access CVE-2026-41940 Type: CRLF...

CVE-2026-34156

🚨 CVE-2026-34156 - Escape Crítico de Sandbox en NocoBase Sin autenticación / privilegios bajos → ejecución remota de código como root en NocoBase 📌 Resumen CVE-2026-34156 es una vulnerabilidad crítica de escape de sandbox en NocoBase una plataforma de código abierto no-code/low-code. Un atacante...

WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read

WGDashboard = 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root. id: CVE-2026-15733 info: name: WGDashboard = 4.3.2 - Authenticated OS Command Injection /etc/passwd Read author: str4k3r,0xAkoko...

PT-2026-84805

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Switches affected versions not specified Description A flaw in the Silicon One integration allows an unauthenticated remote attacker to execute code with root privileges. The issue occurs because TCP ports '43210' and...

CVE-2025-31644

CVE-2025-31644: Inyección de Comandos en Appliance mode en F5 BIG-IP El parámetro “file” del comando “save” es vulnerable a un ataque de inyección de comandos, permitiendo que un atacante autenticado con privilegios de administrador a la API web “/mgmt” o al shell SSH “tmsh”, obtenga ejecución...

Cisco-ASA-vulnerability-research

LINAFULLRE — Full-Coverage Reverse Engineering of lina Created: 2026-08-12 Target: labasav9-12-4-67/lina ASAv 9.12467, ELF x86-64, PIE; Ghidra image base 0x100000; 112,687 functions , 167 MB mapped, 642,707 symbols Track goal: systematic, complete RE coverage of the lina binary — complementing th...

CVE-2026-20079

CVE-2026-20079 Cisco Secure FMC PoC Python proof of concept for the publicly documented Cisco Secure Firewall Management Center authentication-bypass-to-root-RCE chain in CVE-2026-20079. This is not a new vulnerability or independently developed exploit chain. It is a clean-room implementation of...

CVE-2026-65400-poc

CVE-2026-65400 — Lectura de ficheros root pre-autenticación en Compartir Pantalla de macOS PoC de solo lectura Prueba de concepto de solo lectura. Demuestra la omisión de autenticación leyendo un fichero solo-root de un host vulnerable. No escribe nada en el objetivo: ni LaunchDaemon, ni archivo ...

aapanel-ws-bypass

aaPanel: Los proveedores no siempre corrigen las cosas correctamente Una corrección incompleta para CVE-2021-37840 sigue exponiendo 3,6 millones de servidores a RCE como root, 5 años después Descubierto por: EON Security CVE: Pendiente de asignación CVSS: 8.8 Alta —...

tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE 该RCE通过滥用两个漏洞实现： CVE-2026-55494 CVE-2026-62308 简而言之，利用SSRF漏洞调用内部网络中一个未认证的服务，创建一个与tugtainer共享相同PID的docker，从而通过/proc/1/root访问tugtainer docker的文件系统，并且由于创建的docker具有root级别权限，技术上你就在tugtainer docker系统中拥有root权限。 设置 使用本仓库中提供的docker-compose.yml运行docker compose，或者复制粘贴以下内容： root@kitploit...

CVE-2026-20079

🚨 CVE-2026-20079 „Kritischer Cisco-FMC-Zero-Day" Kritische Authentifizierungsumgehung, die zu Root-RCE im Cisco Secure Firewall Management Center führt 📋 Übersicht CVE-2026-20079 ist eine kritische Schwachstelle in der Webschnittstelle der Software Cisco Secure Firewall Management Center FMC. Ein...

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcher Olivier Laflamme has disclosed two independent root remote code execution RCE chains affecting the Unitree G1 EDU , including a Bluetooth Low Energy BLE path that can reach root on the robot's Locomotion PC. The flaws are tracked asCVE-2026-76639 and CVE-2026-76640 , with the...

CVE-2026-63404

Faktory is a language-agnostic background job server. In versions prior to 1.10.0 , its embedded Redis bootstrapper writes startup configuration to the fixed, world-writable path /tmp/redis.conf , creating the file only if absent and never validating it on subsequent boots. A local unprivileged u...

CVE-2026-63586

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...

CVE-2026-63125 Incus vulnerable to root RCE via image backup.yaml symlink

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

CVE-2026-63125 Incus vulnerable to root RCE via image backup.yaml symlink

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

CVE-2026-72840 OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...

CVE-2026-63294 Root RCE via image backup.yaml symlink

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...

CVE-2026-42200

Coolify prior to 4.0.0-beta.474 is affected by a path traversal in the PostgreSQL initialization script handling (generate_init_scripts() in app/Actions/Database/StartPostgresql.php). An authenticated user could write files outside the intended directory during database initialization, enabling c...