CVE-2025-65318-and-CVE-2025-65319

PoC per CVE-2025-65318 e CVE-2025-65319 CVE-2025-65318 BDU:2025-13740: Quando si utilizza la funzionalità di interazione con gli allegati, Canary Mail 5.1.40 e versioni precedenti salva i documenti su un file system senza il tag Mark-of-the-Web, consentendo agli aggressori di bypassare i meccanis...

EUVD-2026-65270

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

CVE-2019-16278

CVE-2019-16278 Uno script Python semplice e veloce per sfruttare la CVE-2019-16278 Nostromo 1.9.6 a partire da una vulnerabilità di Directory Traversal nella funzione httpverify di Nostromo nhttpd che porta a un RCE non autenticato tramite una richiesta HTTP realizzata appositamente. Accetta solo...

CVE-2002-0200

CVE-2002-0200 Cyberstop Web Server für Windows 0.1 erlaubt es entfernten Angreifern, einen Denial of Service über eine HTTP-Anfrage für einen MS-DOS-Gerätenamen zu verursachen. Externe Referenz unter https://marc.info/?l=bugtraq&m=101174569103289&w=2 Autor Alex Hernandez alias @alt3kx...

Oracle Linux 9 : python-urwid (ELSA-2026-58952)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-58952 advisory. - Fix CVE-2026-9323: use cryptographically secure session identifiers in web display module Tenable has extracted the preceding description block directly from...

Linux Distros Unpatched Vulnerability : CVE-2026-78376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption...

Oracle Linux 8 : python-urwid (ELSA-2026-58562)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-58562 advisory. - Use secure random session identifiers in web display CVE-2026-9323 Tenable has extracted the preceding description block directly from the Oracle Linux...

PT-2026-81894

Name of the Vulnerable Software and Affected Versions ClipBucket V5 affected versions not specified Description The web installer fails to properly validate or escape the php cli filepath parameter before passing it to shell execution. This allows unauthenticated attackers to submit a crafted POS...

Adobe-Flash-Exploits_17-18

Adobe Flash Exploits CVE-2015-3090, CVE-2015-3105, CVE-2015-5119 e CVE-2015-5122 Python3 Script Exploit Metasploit convertiti per le vulnerabilità Adobe Flash CVE-2015-3090, CVE-2015-3105, CVE-2015-5119 e CVE-2015-5122 in uno script Python3. Informazioni Questo script ospiterà un server web in...

CVE-2026-32556

Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

barrido

barrido Konsolen-Dienstprogramm zum Auffinden von Webanwendungspfaden. Noch in der Alpha-Version. Beispiele Brute-Force mit mehreren URLs: root@kitploit: $ cat urls.txt https://target.a.com https://target.b.com https://target.c.com $ barrido urls.txt wordlists/quickhits.txt -se | tee...

-CVE-2022-48150

-CVE-2022-48150 Encontrei a vulnerabilidade de XSS refletido no Shopware 5 .para mais detalhes, veja meu vídeo PoC...

Flink_RCE

Apache Flink Web Dashboard: Unautorisierter Zugriff und Upload einer schädlichen JAR-Datei führen zu Remote-Code-Ausführung msf nc Python-Verwendung: python 02-Flink.py http://10.10.20.100:8081 nc.jar...

CVE-2023-23752

Joomla! options...

xray

Welcome to xray 👋 A Powerful Security Assessment Tool 🏠 Documentation • ⬇️ Download xray • ⬇️ Download xpoc • ⬇️ Download xapp • 📖 Plugin Repository 中文版 Note: xray is not open source, just download the built binary files directly. The repository mainly contains community-contributed POCs. Each xray...

CVE-2026-40877

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...

CVE-2026-30864

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting XSS in the dashboard revert functionality. This issue has been fixed in version 3.2.3...

CVE-2022-24716

CVE-2022-24716 Beliebige Datei-Offenlegungsschwachstelle in Icinga Web 2 2.8.6, 2.9.6, 2.10 Icinga Web 2 ist eine Open-Source-Überwachungs-Weboberfläche, ein Framework und eine Befehlszeilenschnittstelle. Nicht authentifizierte Benutzer können den Inhalt von Dateien des lokalen Systems einsehen,...