CVE-2025-46157

CVE-2025-46157 CVE-2025-46157 – Timetrax V1 2025 Remote Code Execution and Privilege Escalation Summary A critical vulnerability was discovered in Timetrax V1 2025 that allows authenticated users to bypass file upload restrictions and achieve remote code execution RCE. The issue exists in the Lea...

CVE-2021-4034

CVE-2021-4034 $ make cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c cc -Wall cve-2021-4034.c -o cve-2021-4034 echo "module UTF-8// PWNKIT// pwnkit 1" gconv-modules mkdir -p GCONVPATH=. cp /usr/bin/true GCONVPATH=./pwnkit.so:. $ ./cve-2021-4034 whoami root exit...

CVE-2023-2744

Exploit Title: WP Plugins WP ERP = 1.12.2 - SQL Injection Date: 15-10-2023 Exploit Author: Arvandy Software Link: https://wordpress.org/plugins/erp/ Vendor Homepage: https://wperp.com/ Version: 1.12.2 Tested on: Windows, Linux CVE: CVE-2023-2744 Product Description WP ERP is the first full-fledge...

CVE-2026-95111

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's "txqueuemessagesize" is a count of "ULONG"s and the co...

CVE-2026-95111

The ThreadX RTOS contains a vulnerability where the front-send dispatcher incorrectly validates a word count as a byte count. Specifically, when a memory-protected module requests a queue operation, the dispatcher fails to multiply the tx_queue_message_size by the size of a ULONG. This allows _tx...

CVE-2026-95111 Module queue front-send validates a word count as a byte count

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

CVE-2026-95111 Module queue front-send validates a word count as a byte count

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

EUVD-2026-105027

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

CVE-2026-95111 Module queue front-send validates a word count as a byte count

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

copy_fail

Copy Fail — CVE-2026-31431 CVE-2026-31431 Copy Fail is a local privilege escalation vulnerability in the Linux kernel's algifaead module AFALG subsystem. A logic flaw introduced in August 2017 allows any unprivileged local user to write 4 controlled bytes into the page cache of any readable file...

CVE-2026-15469

🔑 CVE-2026-15469 Hard-coded Mesh Group Private Key — TP-Link Deco XE75 / XE5300 / WE10800 A shared RSA-512 mesh group private key is baked into the firmware, letting a LAN-adjacent attacker impersonate a trusted mesh node, overwrite configuration, flash unsigned firmware, and pivot across the...

CVE-2024-6387

CVE-2024-6387 CVE-2024-6387 POC Currently being edited openssh CVE-2024-6387 - PoC 📜 Description Note: This script is a quick prototype PoC, expect some errors and bugs may occur. Tested on: Kali Linux, ParrotSec, Ubuntu 22.04 Remote Unauthenticated Code Execution Vulnerability in OpenSSH server ...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 is a reflected XSS vulnerability in Wonder CMS which further allows to execute arbitrary code through a malicious script via the installModule component. Usage Running the exploit against the target's loginURL, specifying our IP and port for the web server hosting th...

CVE-2026-25632

CVE-2026-25632 — JSON Deserialization RCE in REST API Bugfix Challenge Inspired by a real 2026 vulnerability CVSS 10.0, actively exploited Based on: CVE-2026-25632 — Remote Code Execution via unsafe type-driven JSON deserialization discovered in the EPyT-Flow water-network simulation REST API and...

PaperCut-Authentication_Bypass_and_RCE

CVE-2023-27350 — PaperCut NG/MF Authentication Bypass & RCE Standalone Python exploit for the critical authentication bypass and remote code execution vulnerability in PaperCut NG/MF. CVSS 9.8. Description CVE-2023-27350 affects PaperCut NG and MF in versions prior to 20.1.7, 21.2.11, and 22.0.9...

CVE-2017-16995

Linux Kernel Version 4.14 - 4.4 Ubuntu && Debian Description This vulnerability exists in the eBPF bpf2 system call in the Linux kernel. When a user provides a malicious BPF program that causes a calculation error in the eBPF verifier module, it leads to arbitrary memory read/write issues...

AmzWord

AmzWord an automated attack chain based on CVE-2022-30190, 163 email backdoor, and image steganography Thanks to the following github repository, we referenced and modified part of the code to integrate and implement our work: gdog follina virtual-reality 中文README请看这里 Requirements gdog： Python 2....

CVE-2026-54121

🛡️ CVE-2026-54121 — Certighost CTI Investigation Active Directory Certificate Services Privilege Escalation / Domain Compromise Risk Created by Pratik Chhetri Report Date: 2026-07-28 📌 Executive Snapshot Field| Finding ---|--- CVE| CVE-2026-54121 Name| Certighost Vendor| Microsoft Component| Activ...

CVE-2026-42281

CVE-2026-42281: MagicMirror² ≤ 2.35.0 - Unauthenticated SSRF via /cors endpoint Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/magicmirror-ssrf-cve-2026-42281/ Upstream advisory: MagicMirrorOrg/MagicMirror security advisories NVD entry:...

Security update for python-WebOb

This update for python-WebOb fixes the following issues: CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft bsc1275917. Patch Instructions: To install this SUSE upda...