CVE-2025-49132

CVE-2025-49132 Pterodactyl es un panel de gestión de servidores de juegos gratuito y de código abierto. Antes de la versión 1.11.11, usando /locales/locale.json con los parámetros de consulta locale y namespace, un actor malicioso podía ejecutar código arbitrario sin estar autenticado. Con la...

Oracle-WebLogic-CVE-2022-21371

Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Local File Inclusion : CVE-2022-21371 Affected Version: Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 Description: The Oracle Fusion Middleware's Oracle WebLogic Server product Web Container component is vulnerable to local file...

CVE-2020-23589

CVE-2020-23589 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" which allows an unauthenticated, remote attacker to conduct a...

cve-2024-23897-jenkins_lfi_reproduction

CVE-2024-23897 — Vulnerabilidad de Lectura Arbitraria de Archivos en la CLI de Jenkins CVSS 9.8 CRÍTICO — Explotada activamente en la naturaleza Resumen CVE-2024-23897 es una vulnerabilidad crítica de lectura arbitraria de archivos en la interfaz de línea de comandos CLI de Jenkins. La CLI de...

CVE-2026-36848

CVE-2026-36848 A critical path traversal vulnerability was identified in the web-based management engine on port 8089 of Gigamon-VUE OS GVOS appliances. This flaw exists in the legacy H-VUE subsystem within the persistd daemon and allows an unauthenticated, remote attacker with network access to...

cve-2021-44228-log4shell_rce_reproduction

CVE-2021-44228 — Log4Shell: Ejecución Remota de Código en Apache Log4j2 CVSS 10.0 CRÍTICO | CWE-502: Deserialización de Datos No Confiables | CWE-917: Neutralización Incorrecta para Inyección de Lenguaje de Expresión Resumen Log4Shell CVE-2021-44228 es posiblemente la vulnerabilidad más grave de ...

MassCyberCenter-Mentorship-Project-

MassCyberCenter-Mentorship-Project- Descripción general Este repositorio documenta mi recorrido y los entregables durante el programa de mentoría del MassCyber Center. Este programa de mentoría nos encargó completar un proyecto de ciberseguridad y luego presentarlo en un evento de exhibición al q...

CVE-2024-21893.py

CVE-2024-21893 is server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. run python CVE-2024-21893.py -u...

CVE-2021-4045

Exploit Title: TP-LINK Tapo c200 1.1.15 - RCE Vendor: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/ Version: 1.1.15 and below CVE: CVE-2021-4045 Loadable C2 botnet & massexploit Write up of vuln: https://www.hacefresko.com/posts/tp-link-tapo-c200-unauthenticated-rce...

CVE-2022-34919

CVE-2022-34919 Contensis Content Management System prior to version 15.2.1.79 has a flaw in their 'Classic' interface that allows an unauthenticated user to upload and approve arbitrary files. By uploading an aspx file, it is possible to execute commands in the context of the web server. This...

CVE-2022-31814

CVE-2022-31814 root@kitploit: Reworked and optimized exploit script of pfBlockerNG 2.1.426 vulnerability Exploit Title: pfBlockerNG 2.1.426 - Remote Code Execution RCE Shodan Results:...

CVE-2026-31309

CVE-2026-31309: Improper Access Control in Mysterium Node before v1.36.0 Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node...

CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 SSRF sin autenticación CVE-2024-48360 | Qualitor = v8.24 SSRF sin autenticación Descripción Qualitor es una plataforma para la gestión de procesos empresariales, y este sistema está presente en varias empresas de Brasil que pueden ser identificadas simplemente...

CVE-2020-6308-PoC

CVE-2020-6308 SAP POC SAP BusinessObjects Business Intelligence Platform Web Services versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. Follow me on...

CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE Resumen: Este documento muestra cómo combinar dos vulnerabilidades de FreePBX 16 CVE-2025-57819 y CVE-2025-61678 para lograr una cadena de ataque completa que permite escalar desde el acceso no autenticado hasta la ejecución remota de código Remote Code...

CVE-2022-29464

CVE-2022-29464 A preauth arbitrary file upload that leads to RCE in WSO2 Summary of the CVE CVE-2022-29464 is a RCE vulnerability for WSO2 discovered by Orange Tsai. A unauthenticated arbitrary file upload allows an attacker to execute code by uploading a malicious JSP file. Affected Versions WSO...

CVE-2022-30525

CVE-2022-30525 Zyxel Firewall Command Injection Vulnerability CVE-2022-30525 POC&EXP author:160team.west9B For use only by authorized security researchers. Comply with cybersecurity laws. Any issues arising are your own responsibility, and the author bears no liability. 01-Introduction On May 12,...

CVE-2025-8422

CVE-2025-8422 Propovoice targetfile Examples: python3 cve-2025-8422-exploit.py https://example.com [email protected] python3 cve-2025-8422-exploit.py https://example.com [email protected] /../../../wp-config.php...

CVE-2019-15107-Exploit

CVE-2019-15107 Python Exploit This exploit is for CVE-2019-15107 Webmin 1.890-1.920 unauthenticated RCE implemented in Python. Usage root@kitploit: python3 webminExploit.py python3 webminExploit.py 10.200.198.200 10000 whoami python3 webminExploit.py 10.200.198.200 10000 "curl -h"...

EUVD-2026-68458

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...