CVE-2026-49049

CVE-2026-49049 Mass Scanner Mass vulnerability scanner for CVE-2026-49049 - Unauthenticated Remote Code Execution in Joomla Helix3 Framework. 📌 Description This tool checks multiple Joomla sites for the CVE-2026-49049 vulnerability found in the Helix3 plugin. The vulnerability allows an...

poc-cve-xss-encoded-wp-inventory-manager-plugin

Actualización - 5/10/2023 El ID CVE-2023-2123 fue reservado y el PoC fue publicado en el sitio web de WPScan: https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1 Detalles Título: Cross-Site Scripting Reflejado No Autenticado en el Plugin WP Inventory Manager para WordPress CMS...

Golang-CVE-2021-44077-POC

Golang-CVE-2021-44077-POC This exploit is an unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus msiexec.exe Then, run the exploit. go run CVE-2021-44077.go -u "http://192.168.1.3:8080/" -f "/msiexec.exe" -u is the vulnerable URL -f is your malicious file...

shirocrack

shirocrack Simple cracker de hashes para Apache Shiro escrito en Golang. Útil para explotar CVE-2024-4956. Mantengámoslo breve CVE-2024-4956 es una vulnerabilidad de path traversal en Sonatype Nexus Repository que permite a un atacante no autenticado con acceso de red al servidor leer archivos...

cve-2025-64446-fortiweb-exploit

Exploit de Recorrido de Ruta y Ejecución Remota de Código CVE-2025-64446 para Fortinet FortiWeb Una herramienta de investigación de seguridad para detectar y probar la vulnerabilidad CVE-2025-64446 en el Firewall de Aplicaciones Web WAF Fortinet FortiWeb. Esta vulnerabilidad crítica de recorrido ...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

CVE-2022-35914

CVE-2022-35914 RCE no autenticado en GLPI 10.0.2 PoC root@kitploit: curl -s -d 'sid=foo&hhook=exec&text=cat /etc/passwd' -b 'sid=foo' http://HOST/vendor/htmlawed/htmlawed/htmLawedTest.php |egrep '\ \0-9+\ ='| sed -E 's/\ \0-9+\ =\ ./\1/'...

CVE-2025-57819

CVE-2025-57819 Overview of this vulnerability quoted from @jfinstrom here Around 2025-08-21 multiple FreePBX systems began showing errors and later confirmed compromises. Vendor Sangoma/FreePBX Security Team published an advisory on 2025-08-26 urging administrators to restrict public access to th...

CVE-2022-43110

CVE-2022-43110 Further Information Voltronic Viewpower/Pro and rebrands/derivatives The UPS management software is supposed to only allow a properly Authenticated and Authorized admin user using a web interface to configure the system. Due to CWE-425: Direct Request 'Forced Browsing' an...

Oracle-WLS-Weblogic-RCE

Oracle-WLS-Weblogic-RCE CVE-2019-2725 Oracle WLSWeblogic RCE test sciript CVE-2019-2725 is a deserialization vulnerability in Oracle WebLogic Server. This remote code execution vulnerability is remotely exploitable without authentication. This script which check the presence or absence of a page ...

spip-cve-2023-27372-rce

Exploit de RCE no autenticada CVE-2023-27372 en SPIP Subida de Web Shell Este script de Python explota CVE-2023-27372, una vulnerabilidad de ejecución remota de código no autenticada en SPIP CMS versiones anteriores a 4.2.1. Aprovecha una falla de envenenamiento de caché en el mecanismo de...

CVE-2022-22029-NFS-Server-

Windows Network File System Remote Code Execution Vulnerability CVE-2022-22039 To successfully exploit this vulnerability, an attacker must succeed in a race condition. Making an unauthenticated, carefully constructed call to a Network File System NFS service could be used to exploit this...

rpc-rce.py

Exploit RCE de rpc.py CVE-2022-35411 Este es un exploit actualizado y mejorado para CVE-2022-35411 , que apunta a versiones vulnerables de rpc.py Exploit original de : Elias Hohl Mejorado por : x7331 por usabilidad, portabilidad y automatización Resumen de la Vulnerabilidad La vulnerabilidad radi...

CVE-2021-31862

CVE-2021-31862 SysAid 20.4.74 permite XSS reflejado a través del parámetro KeepAlive.jsp, sin autenticación. Cronología Descubierto: 28 de abril de 2021 Contacto inicial con el proveedor: 28 de abril de 2021 Reportado: 28 de abril de 2021 ID de CVE emitido: 28 de abril de 2021 Contacto secundario...

EUVD-2026-72126

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

CVE-2026-86259

OpenMAIC versions before 1.0.1 contain a server-side request forgery (SSRF) vulnerability in non-production builds where URL validation is gated by environment. Unauthenticated attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter, reaching cloud instance met...

CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...

CVE-2026-86253

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

CVE-2026-86242

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...