Gitlab-CVE-2026-19478

CVE-2026-19478 — Inyección de directiva @glintroduced en GraphQL de GitLab Inyección remota de código sin autenticación mediante directiva GraphQL en GitLab CE/EE — Eliminar cualquier proyecto público con una sola petición HTTP Un laboratorio práctico de pruebas de penetración que reproduce...

CVE-2025-64446

CVE-2025-64446 FortiWeb Unauthenticated RCE via Path Traversal & CGI Auth Bypass...

CVE-2021-24499

CVE-2021-24499 Explotación masiva de CVE-2021-24499: subida no autenticada que conduce a ejecución remota de código en el tema Workreap. Las acciones AJAX workreapawardtempfileuploader y workreaptempfileuploader no realizaban comprobaciones de nonce ni validaban de ninguna otra forma que la...

CVE-2025-32433

CVE-2025-32433: Erlang/OTP's SSH Server Exploit Information CVE-2025-32433: A critical flaw has been discovered in Erlang/OTP's SSH server allows unauthenticated attackers to gain remote code execution. One malformed SSH handshake bypasses authentication and exploits improper handling of SSH...

spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header root@kitploit: spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" 构建 root@kitploit: wget...

staystaystay

staystaystay staystaystay is a proof of concept exploit for CVE-2021-1585, a man in the middle or evil endpoint RCE issue affecting Cisco ASA Device Manager ASDM. The issue was originally discovered by Malcolm Lashley and disclosed in the summer of 2021. However, at the time I was looking at this...

ipeeyoupeewepee

ipeeyoupeewepee Un escáner y suite de ataque para hosts en internet público principalmente routers Cisco que reenvían paquetes no autenticados encapsulados en los protocolos IP-in-IP y GRE. Esta vulnerabilidad, conocida como "Insecure Implementation of Tunneling Protocols", está rastreada bajo...

CVE-2020-11978

CVE-2020-11978: Remote code execution in Apache Airflow's Example DAGs Information Description: This vulnerability allows RCE when Airflow's example DAGs are loaded, potentially unauthenticated with CVE-2020-13927 CVE Credit : xuxiang of DtDream security Versions Affected:...

CVE-2019-16278

CVE-2019-16278 Simple Python script to exploit CVE-2019-16278 due to a path traversal vulnerability that leads to unauthenticated RCE. Usage: python3 nostroSploit.py targetIP targetPort optional command to run Inspired by:...

CVE-2019-11581

Atlassian Jira unauthenticated template injection CVE-2019-11581 I Building 1. Bug versions root@kitploit: 4.4.x 5.x.x 6.x.x 7.0.x 7.1.x 7.2.x 7.3.x 7.4.x 7.5.x 7.6.x before 7.6.14 the fixed version for 7.6.x 7.7.x 7.8.x 7.9.x 7.10.x 7.11.x 7.12.x 7.13.x before 7.13.5 the fixed version for 7.13.x...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.0 RCE vulnerability This is a script to exploit CVE-2017-5638 - It allows an attacker to inject OS commands into a web application through the content-type header Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It...

CVE-2026-51667

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51666

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2023-4549

ID de CVE : CVE-2023-4549 Tipo de Vulnerabilidad : Cross-Site Scripting Descripción : El plugin DoLogin Security para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del encabezado 'X-Forwarded-For' en versiones hasta la 3.6 inclusive, debido a una insuficiente sanitización de...

cve-2025-29384-poc

CVE-2025-29384 Proof-of-Concept Exploit Overview This repository contains an advanced proof-of-concept PoC exploit for CVE-2025-29384 , a critical stack-based buffer overflow vulnerability discovered in the Tenda AC9 router running firmware version V15.03.05.14multi. This vulnerability allows...

CVE-2025-13342

CVE-2025-13342 PoC The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This allows attackers to register users and set the default role to administrator. Exploitation becomes...

CVE-2024-7954

CVE-2024-7954 Este exploit intentará ejecutar comandos del sistema en objetivos SPIP CVE-2024-7954. Visión general Esta es una herramienta de escaneo y explotación masiva para CVE-2024-7954: SPIP 4.2.8 permite a atacantes no autenticados lanzar RCE en objetivos SPIP. Esta herramienta está basada ...

CVE-2024-6782

CVE-2024-6782 Calibre ejecución remota de código CVE-2024-6782. El control de acceso inadecuado en Calibre 6.9.0 7.14.0 permite a atacantes no autenticados lograr la ejecución remota de código...

CVE-2025-53770

CVE-2025-53770 This is a multiple site scanner for CVE-2025-53770 Unauthenticated RCE Vulnerability. Other scanners/PoCs:- https://github.com/hazcod/CVE-2025-53770 https://github.com/MuhammadWaseem29/CVE-2025-53770 CVE-2025-53770 Sharepoint RCE Impact: Unauthenticated attackers can achieve remote...

CVE-2023-43208-mirth-connect-rce-poc

RCE vulnerability in Mirth Connect CVE-2023-37679 and CVE-2023-43208 This exploit script and PoC are written for an in-depth CVE analysis on vsociety. CVE-2023-43208 is a serious security bug in NextGen Mirth Connect, a tool used by hospitals and clinics to share patient data. This bug lets hacke...