CVE-2019-9193-Home-Lab

ENGLISH BELOW CVE-2019-9193 — PostgreSQL COPY FROM PROGRAM RCE Lab นี้จำลองช่องโหว่ CVE-2019-9193 ที่เกิดใน PostgreSQL เวอร์ชัน 9.3 - 11.2 ซึ่งเปิดให้ user ที่เป็น superuser หรือมี role pgexecuteserverprogram สามารถใช้คำสั่ง: COPY ... FROM PROGRAM '' เพื่อรันคำสั่ง OS ได้โดยตรง ส่งผลให้เกิด Remot...

CVE-2026-110612

The vlife application (versions through 2.0.1 ) is vulnerable to an authentication bypass due to a hardcoded HS256 signing key located in the TokenUtil component. This flaw allows unauthenticated attackers to forge JWTs by injecting superUser=true and arbitrary groupIds claims, granting them supe...

CodeChecker <= 6.24.1 - Authentication Bypass

Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. id: CVE-2024-10081 info:...

CVE-2026-74035

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...

Better-CVE-2022-29464

Better CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a...

CVE-2026-25212

CVE-2026-25212 – Percona PMM RCE PoC Critical – CVSS 9.9 – Authenticated Remote Code Execution in PMM 3.7. Description This proof‑of‑concept exploits a vulnerability where an internal PostgreSQL user in PMM retains 'SUPERUSER' privileges. An authenticated attacker with 'pmm-admin' rights can abus...

CVE-2025-8714-POC

CVE-2025-8714-POC PoC de RCE en PostgreSQL — CVE-2025-8714 PoC de Ejecución Remota de Código en PostgreSQL — CVE-2025-8714 pgdump Reverse Shell Este repositorio presenta una prueba de concepto PoC para la vulnerabilidad crítica CVE-2025-8714 que afecta a versiones PostgreSQL anteriores a: 17.6,...

CVE-2026-108740

GoatCounter versions through 2.7.0 are vulnerable to a mass assignment privilege escalation flaw in the userPrefSave handler. This vulnerability allows authenticated users to modify protected account fields via form-encoded requests to the /user/pref endpoint. Specifically, an attacker with read-...

CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...

CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...

EUVD-2026-96906

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...

cve-2019-9193

CVE-2019-9193 • CVE-2019-9193 Vulnerability PostgreSQL has a vulnerability that allows arbitrary code execution within the DB's operating system via the “COPY TO / FROM PROGRAM” feature. The attack vector involves users who are “SuperUser” or belong to the “pgexecuteserverprogram” group...

EXPLOIT-CVE-2026-9198

CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of-concept exploit and a self-contained Docker lab for CVE-2026-9198 , an unauthenticated remote code execution vulnerability in IBM Langflow OSS. The exploit chains two endpoints — autologin which hands out a SUPERUSER token to anyone an...

CVE-2026-9198

CVE-2026-9198 Vulnerability cause: IBM Langflow OSS is an open-source software specifically used for building and deploying Agent automation workflows. IBM Langflow OSS from 1.0.0 to 1.10.0 has automatic login enabled by default autologin is true. In this mode, accessing the /api/v1/autologin...

CVE-2026-16764

CVE-2026-16764 Privilege Escalation in OWASP DefectDojo via isstaff API bypass. Summary A user with only auth.changeuser permission can escalate to superuser in two steps: 1. Set isstaff=true on their own account via REST API validation only blocks issuperuser 2. Access Django Admin and check...

CVE-2026-2005_lab

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow Lab A self-contained Docker lab for practicing exploitation of CVE-2026-2005, a heap buffer overflow in PostgreSQL's pgcrypto extension that enables remote code execution without superuser privileges. Affected versions: PostgreSQL ≤ 17.7 / 16.11 /...

CVE-2024-24919-Check-Point-Remote-Access-VPN

CVE-2024-24919-Check-Point-Remote-Access-VPN CVE-2024-24919 is an unauthenticated arbitrary file read vulnerability that can be treated nothing less than a full unauthenticated RCE. An attacker can read any sensitive files located on the affected appliance with superuser access. An attacker can...

CVE-2026-52887-NocoBase-SQLi-RCE

CVE-2026-52887 — NocoBase SQL Injection → PostgreSQL-superuser RCE SQL injection in the myInAppChannels:list action of NocoBase's @nocobase/plugin-notification-in-app-message ≤ 2.0.60. The filterlatestMsgReceiveTimestamp$lt request parameter is interpolated directly into a raw Sequelize.literal S...

EUVD-2026-91833

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-94592

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...