CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. Exposición pública de direcciones de correo electrónico de usuarios CVE-2025-59843 Alcance / Aplicación afectada: FlagForge Web Application Endpoint de API: /api/user/username Detalles: El endpoint devuelve las direcciones de correo electrónico de los usuarios...

CVE-2018-14847-EXPLOIT

CVE-2018-14847 - MikroTik WinBox File Read 💥 MikroTik RouterOS through version 6.42 is affected by a directory traversal vulnerability in the WinBox interface, allowing unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files. This...

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager ARM that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326 , is rated 8.8 out of 10.0 on the CVSS scoring...

Hadoop-YARN-RCE

Unauthenticated RCE in Apache Hadoop YARN ResourceManager An unauthorized access vulnerability exists in Apache Hadoop YARN ResourceManager when its REST API default port 8088 or RPC ports are exposed without authentication enabled. By default, Hadoop leaves HTTP web consoles and RPC services...

CVE-2026-9289

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2025-46047

CVE-2025-46047 Silverpeas = 6.4.2 Username Enumeration PoC Proof-of-Concept script for demonstrating a username enumeration vulnerability in Silverpeas versions 6.4.1 and 6.4.2. Vulnerability Details Affected Software: Silverpeas Affected Versions: 6.4.1, 6.4.2 and potentially earlier versions...

CVE-2026-44402

CVE-2026-44402 Pre-Authenticated Full Remote Command Execution in Voltronic Power SNMP Web Pro 1.1 Content Affected Vendor: https://voltronicpower.com/ Affected product: SNMP Web pro 1.1 SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi endpoint. T...

CVE-2024-6366

Para crear un módulo de Metasploit para explotar la vulnerabilidad RCE en el plugin User Profile Builder de WordPress anterior a la versión 3.11.8, necesitamos aprovechar la falta de autorización adecuada en la funcionalidad de carga de archivos multimedia. Así es como puedes crear dicho módulo d...

CVE-2019-15896

CVE-2019-15896 LifterLMS = 3.34.5 - Unauthenticated Options Import Description Unauthenticated Options Import, which could lead to Website Redirection Administrator Account Creation Content Injection Stored XSS The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional inp...

CVE-2025-32433

CVE-2025-32433 CVE-2025-32433 Summary and Attack Overview CVE-2025-32433 is a critical unauthenticated remote code execution RCE vulnerability in the Erlang/OTP SSH server, disclosed on April 16, 2025. Erlang/OTP SSH is a library used in various distributed and telecom applications. The flaw aris...

CVE-2019-17382-EXPLOIT

CVE-2019-17382 - Zabbix Authentication Bypass A critical vulnerability discovered in Zabbix versions up to 4.4. The issue exists within the zabbix.php file when accessing the dashboard.view action with dashboardid=1. It enables attackers to bypass the login page, granting unauthorized access to t...

CVE-2026-9289

WordLift – AI powered SEO – Schema plugin for WordPress (versions up to and including 3.54.10 ) is vulnerable to unauthenticated sensitive information exposure via its JSON-LD REST API endpoints (/wordlift/v1/jsonld/). The root cause is that these routes are registered with a permission_callback ...

CVE-2026-9289 WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

Apache-OFBiz-Exploit

Apache-OFBiz-Exploit Exploit para Apache OFBiz CVE-2024-38856 Por: Alisson Faoli Descripción Este repositorio contiene un exploit para la vulnerabilidad CVE-2024-38856 encontrada en Apache OFBiz. El fallo permite una RCE Ejecución Remota de Código sin autenticación. Nota: Este exploit se...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 POC, vulnerabilidad de inyección de comandos en el servidor web de algunos productos Hikvision. Debido a la validación de entrada insuficiente, un atacante puede explotar la vulnerabilidad para lanzar un ataque de inyección de comandos enviando mensajes con comandos...

CVE-2022-26134-Confluence-RCE

Exploit for CVE-2022-26134: Confluence Pre-Auth Remote Code Execution via OGNL Injection Another exploit in OGNL Land Description Confluence is a web-based corporate wiki developed by Australian software company Atlassian. On June 02, 2022 Atlassian released a security advisory for their Confluen...

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 CVSS v3.1 score: 9.8/CVSS v4 score: 9.3, which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2025-26319

CVE-2025-26319 1. Basic File Upload python flowiseexploit.py -u http://target:3000 -f localfile.txt -d /path/on/server/file.txt 2. Upload Configuration File Modify API key configuration python flowiseexploit.py -u http://target:3000 -f newapi.json -d /root/.flowise/api.json 3. Auto-generate and...

CVE-2025-48466

CVE-2025-48466 Modbus Packet Injection on Advantech WISE 4060LAN / IoT Gateway for door control. see script: main.py Summary I was able to figure out that it is just very easy to somehow manipulate the Modbus server running on an IoT Gateway for door control on a network. Any remote attacker...