EUVD-2026-38245

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation...

CVE-2025-47812

CVE-2025-47812 Improper input validation led to Remote Code Execution to full system compromise 📘 Introduction: Julien Ahrens from RCE Security discovered a critical security vulnerability impacting WingFTP. Tracked as CVE-2025-47812, the vulnerability has a CVSS score of 10. Successful...

CVE-2025-42957-SAP-S-4HANA-Under-Siege

CVE-2025-42957-SAP-S-4HANA-Under-Siege 1 – What Happened? In August 2025, SAP’s flagship ERP platform S/4HANA was found to expose a vulnerability in one of its RFC‑enabled function modules. Attackers who possess only low‑privileged access can inject arbitrary ABAP code into that module, bypassing...

CVE-2024-4577

CVE-2024-4577: Critical Vulnerability in PHP's CGI Configurations A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters. Impacted Versions PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi. Attack Methodology...

CMSimple 3.1 - Local File Inclusion

CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when registerglobals is enabled which allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including...

Lansweeper Unauthenticated SQL Injection

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. id: CVE-2019-13462 info: name: Lansweeper Unauthenticated SQL Injection author: divyamudgal severity: critical description: Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. impact: | This vulnerability can lead to...

Vanna - SQL injection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

11in1 CMS 1.2.1 - Local File Inclusion (LFI)

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php. id: CVE-2012-0996 info: name: 11in1 CMS 1.2.1 - Local File Inclusion LFI author: daffainfo...

Paperclip - Remote Code Execution

Paperclip 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target. id: CVE-2026-41679 info: nam...

cve-2018-14634

cve-2018-14634 This is a exploit published for researchers discovered by cloud-based security and compliance solution provider Qualys Affect kernel versions 2.6.x, 3.10.x and 4.14.x To successfully exploit this vulnerability, attackers need to have access to the targeted system and run their...

wp-file-manager-CVE-2020-25213

WP-file-manager expoit CVE-2020-25213 WP-file-manager wordpress plugin 6.9 vulnerable to unauthenticated arbitary file upload resulting in full compromise of the system. For More more details refer to my writeup published here Disclaimer I haven't discovered this vulnerability & neither taking an...

CVE-2019-9745

Author: Arn Vollebregt Introduction Creativity is at the core of penetration testing, which keeps our work interesting. One pitfall however is the tendency to 'over-engineer' attack scenarios and focus solely on bugs error conditions. Flaws unintended behaviour may however be present with equally...

mikrotik0dayScanner

Mikrotik 0day Credential Disclosure Scanner Description: The vulnerability allows a remote attacker to execute arbitrary code on the target system. The weakness exists due to improper authentication in the exposed by default Winbox interface on port 8291/TCP. A remote attacker can send specially...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb con la versión 6.1.2.0 o inferior, contiene una vulnerabilidad de Ejecución Remota de Código RCE dentro de su función de Configuración de Notificaciones. Un atacante autenticado con privilegios de "Configuración del Sistema" en ASWeb puede explot...

USN-8851-3: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...

CVE-2025-53770

CVE-2025-53770 This is a multiple site scanner for CVE-2025-53770 Unauthenticated RCE Vulnerability. Other scanners/PoCs:- https://github.com/hazcod/CVE-2025-53770 https://github.com/MuhammadWaseem29/CVE-2025-53770 CVE-2025-53770 Sharepoint RCE Impact: Unauthenticated attackers can achieve remote...

CVE-2024-38077

CVE-2024-38077 Here’s a possible GitHub description for CVE-2024-38077: CVE-2024-38077: Remote Code Execution Vulnerability in Windows Remote Desktop Licensing Service Overview: CVE-2024-38077 is a critical vulnerability in the Windows Remote Desktop Licensing Service, which allows remote attacke...

CVE-2026-36213

CVE-2026-36213 CVE-2026-36213 | Local Privilege Escalation in MEmu Android Emulator 9.2.7.0 via Insecure Service Binary Permissions | Patched in 9.3.2 CVE-2026-36213 — MEmu Android Emulator 9.2.7.0 LPE Summary A Local Privilege Escalation LPE vulnerability in MEmu Android Emulator 9.2.7.0. The...

-CVE-2025-8088

-CVE-2025-8088 POWERSHEL script to check if your device is affected or no 🚨 CVE-2025-8088: WinRAR Zero-Day Alert! 🚨 A critical WinRAR vulnerability CVE-2025-8088 is making headlines – attackers can exploit this flaw in versions 7.13 to execute malicious code just by tricking users into opening a...

BIQS IT Biqs-drive v1.83 Local File Inclusion

A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user. id: CVE-2021-394...