44 matches found
CVE-2025-53694-to-CVE-2025-53691
Exploração em Cadeia de CVEs do Sitecore Este repositório contém explorações de prova de conceito para uma cadeia de vulnerabilidades críticas no Sitecore Experience Platform XP até a versão 10.4.1. Vulnerabilidades CVE-2025-53694: Divulgação de Informações CVE-2025-53693: Envenenamento de Cache...
POC_CVE-2026-41940
POCCVE-2026-41940 Início rápido python3 pocCVE-2026-41940.py -h Exemplos de uso Verificar um único host python3 pocCVE-2026-41940.py -u https://target.example:2086 Listar contas após a cadeia bem-sucedida python3 pocCVE-2026-41940.py -u https://target.example:2086 --action list Executar um comand...
wp2shell-scanner
Scanner wp2Shell – com PoC CVE-2026-63030 e CVE-2026-60137 – Scanner da cadeia de vulnerabilidade wp2shell do WordPress Ferramenta autorizada de pesquisa de segurança com PoC opcional de verificação de comando. wp2shell-scanner detecta a cadeia de vulnerabilidade wp2shell do WordPress validando...
wp2shell-lab
wp2shell lab & detector + pre-auth RCE PoC A self-contained lab, non-destructive detector , and full pre-auth RCE proof-of-concept for wp2shell — the pre-authentication vulnerability chain in WordPress core: CVE| Component| Class| CVSS ---|---|---|--- CVE-2026-60137| WPQuery::authornotin| SQL...
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...
CVE-2026-44103
The CVE-2026-44103 entry details an unauthenticated remote code/integrity issue where the JupiCore firmware update mechanism transmits updates without integrity or verification checks, allowing an attacker to inject malicious firmware into the internal charging module. This could compromise devic...
PT-2026-66431
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...
WP2Shell WordPress Exploit Technical Analysis and Real Attack Data
On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...
Exploit for Deserialization of Untrusted Data in Dataease
DataEase — Unauthenticated RCE via a 4-vulnerability chain CV...
wp2shell
wp2shell — Pre-Auth RCE in WordPress core Unauthenticated W...
vulnerability_chain_exploitation_lab_new
No d...
Exploit for Path Traversal in Tp-Link Tapo_C260_Firmware
Tapo C260 RCE Chain CVE-2026-0651 / CVE-2026-0652 / CVE-2026-...
The Hardest Fork
Mythos is real. I know a big chunk of the industry thinks it's a marketing stunt, and I get why. I get it. But I've seen the findings, and they're bad. These aren't "whoops, this line right here is wrong, and that's RCE." They're novel combinations of a few dozen issues out of thousands of things...
Linux Kernel - Local Privilege Escalation
Titles: Linux Kernel Local Privilege Escalation CVE-2026-43284 / CVE-2026-43500 / CVE-2026-46300 Author: nu11secur1ty Date: 2026-05-11 Vendor: Linux Kernel Software: Linux Kernel All major distributions Vulnerability Type: Page-Cache Write / Memory Corruption Status: HIGH / CRITICAL --- Descripti...
Exploit for CVE-2026-47102
CVE-2026-47102 – LiteLLM Privilege Escalation via /user/updat...
PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks
A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025. That's according to a report published by Positive Technologies, which found the threat actors to be leveragin...
@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +18 more potentially affected by CVE-2026-43569 via openclaw (>=2026.3.22, <=2026.4.5)
openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-43569 Source advisory: OSV:GHSA-939R-RJ45-G2RJ...
GHSA-37J7-56XC-C468 Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Affected Versions: Tested on current dev branch build fingerprint 505...7bd86 CVSS v4 Score: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Privileges Required: Web application admin account for file write, any authenticated user for RCE trigger --- Summary Two separate...
📄 Sitecore Experience Manager / Experience Platform 10.1 Shell Upload / Hardcoded Credentials
Proof of concept exploit for a remote code execution vulnerability chain affecting Sitecore Experience Platform versions 10.x combining hardcoded credentials with file upload vulnerabilities for complete system compromise...