CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI RCE CVE-2020-5902 è una vulnerabilità critica di Esecuzione Remota di Codice RCE non autenticata nell'Interfaccia Utente di Gestione del Traffico TMUI / utility di configurazione di F5 BIG-IP. 📌 Panoramica Divulgata da F5 il 30 giugno 2020 pubblicata su NVD il 1°...

CVE-2026-49869

Kestra CVE-2026-49869 / CVE-2026-53576 Scanner Esegue la scansione delle istanze Kestra per il bypass del filtro di autenticazione endsWith"/configs". Il file AuthenticationFilter.java di Kestra controlla request.getPath.endsWith"/configs" invece di confrontare il percorso esatto /api/v1/configs...

CVE-2021-30461

Prodotti interessati VoIPmonitor 24.60 Come eseguire RCE root@kitploit: python3 CVE-2021-30461.py -t ipaddress Shell del browser: root@kitploit: http://x.x.x.x/namrlblgel.php?a=whoami Riferimento https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/...

CVE-2025-34085

CVE-2025-34085 — Simple File List di WordPress RCE non autenticato Un exploit automatizzato per CVE-2025-34085 duplicato di CVE-2020-36847, una vulnerabilità critica di esecuzione di codice in remoto non autenticata nel plugin WordPress Simple File List versioni ≤ 4.2.2. Nota: CVE-2025-34085 è...

CVE-2025-53770

CVE-2025-53770 Questo è uno scanner multi-sito per la vulnerabilità RCE non autenticata CVE-2025-53770. Altri scanner/PoC:- https://github.com/hazcod/CVE-2025-53770 https://github.com/MuhammadWaseem29/CVE-2025-53770 CVE-2025-53770 Sharepoint RCE Impatto: Gli attaccanti non autenticati possono...

CVE-2021-3129

CVE-2021-3129 Esecuzione di codice remoto non autenticata in Laravel Ignition tramite caricamento di file Riepilogo della CVE Nelle versioni interessate di Laravel Ignition, un attaccante può eseguire codice arbitrario a causa dell'uso insicuro di filegetcontents e fileputcontents. Questo è...

SessionReaper-CVE-2025-54236

SessionReaper — CVE-2025-54236 PoC unificato per CVE-2025-54236 "SessionReaper", una RCE critica non autenticata in Magento 2 / Adobe Commerce tramite deserializzazione annidata nella REST API. CVSS: 9,1 Critico Causa principale: Validazione input impropria CWE-20 in ServiceInputProcessor; la...

CVE-2026-44277

🚨 CVE-2026-44277 - RCE Não Autenticado no FortiAuthenticator Execução Remota de Código Crítica e Não Autenticada no Fortinet FortiAuthenticator 📋 Visão Geral CVE-2026-44277 é uma vulnerabilidade crítica no Fortinet FortiAuthenticator que permite que atacantes não autenticados alcancem Execução...

BigFinger

CVE-2023-46747 - Big-IP RCE Nicht authentifiziert Dies ist ein Python3-Skript, das die nicht authentifizierte Remote-Codeausführungs-Schwachstelle CVE-2023-46747 in F5 BIG-IP -Appliances über die TMUI-Schnittstelle ausnutzt. Grundsätzlich erhältst du, wenn diese Schwachstelle ausgenutzt wird, ein...

CVE-2021-38647

CVE-2021-38647 CVE-2021-38647 – POC zur Ausnutzung von nicht authentifiziertem RCE OMIGOD auf Azure UNIX/Linux-VMs! Details In Microsofts Azure wird die OMI-Anwendung automatisch installiert, wenn Dienste wie Azure Automation Accounts, Update Management, Log Analytics, Configuration Management us...

Exch-CVE-2021-26855_Priv

Exch-CVE-2021-26855 ProxyLogon è il nome generico formale per CVE-2021-26855, una vulnerabilità su Microsoft Exchange Server che consente a un attaccante di bypassare l'autenticazione e impersonare l'amministratore. Abbiamo anche concatenato questo bug con un'altra vulnerabilità post-autenticazio...

CVE-2022-20699

CVE-2022-20699 🎧 Portato a voi da the Audiobahn Cisco Anyconnect VPN RCE non autenticato rwx stack non è stato ben verificato...

CVE-2025-24813

Apache Tomcat Nicht authentifizierte RCE - CVE-2025-24813 Dieses Repository bietet eine Anleitung und eine Testumgebung zur Bewertung der CVE-2025-24813 -Sicherheitslücke. Details Betroffene Versionen: Apache Tomcat 11.0.0-M1 bis 11.0.2 Apache Tomcat 10.1.0-M1 bis 10.1.34 Apache Tomcat 9.0.0.M1 b...

PT-2026-82209

Name of the Vulnerable Software and Affected Versions SENAITE.CORE versions 2.0.0 through 2.6.0 Description An unauthenticated remote code execution issue exists in the SENAITE JSON API due to a chain of missing authorization and unsafe evaluation of input. The state-changing routes in...

CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner

CYBERDUDEBIVASH Cisco AsyncOS CVE-2025-20393 Scanner Copyright © 2026 CYBERDUDEBIVASH ECOSYSTEM – Tutti i diritti riservati Autorizzato da CYBERDUDEBIVASH AUTHORITY – Strumento di rilevamento etico per CVE-2025-20393 RCE non autenticata in Cisco Secure Email Gateway / SMA. Questo strumento aiuta ...

CVE-2025-13597

AI Feeds = 1.0.11 - رفع ملف تعسفي غير مصادق عليه يحتوي إضافة ووردبريس AI Feeds في الإصدارات 1.0.11 وما دون على ثغرة تنفيذ تعليمات برمجية عن بُعد غير مصادق عليها في ملف actualizadorgit.php. يمكن الوصول إلى هذا الملف مباشرة عبر HTTP دون أي تحقق من المصادقة أو التفويض، مما يسمح للمهاجمين غير المصادق...

CVE-2025-13595

CIBELES AI = 1.10.8 - बिना प्रमाणीकरण के मनमाना फ़ाइल अपलोड Cibeles AI WordPress प्लगइन के संस्करण 1.10.8 और उससे नीचे में actualizadorgit.php फ़ाइल में एक बिना प्रमाणीकरण वाली रिमोट कोड निष्पादन भेद्यता मौजूद है। यह फ़ाइल बिना किसी प्रमाणीकरण या प्राधिकरण जांच के HTTP के माध्यम से सीधे एक्सेस की...

GHSA-W3FX-MC44-MF6J Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-45018

Chainlit (Python framework for conversational AI applications) is vulnerable to command injection via its MCP stdio transport in versions 2.4.0rc0 through 2.12.0 . When features.mcp.enabled is set to true, the POST /mcp endpoint is exposed without authentication . The validate_mcp_command() funct...