51571 matches found
Escargot 4.3.0-214-gfaee4437 Command Injection
An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...
...[ More ]
Chronicle Wire's FileMarshallableOut follows symbolic links when writing files in append mode. When ?append=true is enabled, the implementation opens the supplied output path directly using FileOutputStreampath, true without preventing symbolic-link resolution. If an attacker can create or replac...
TBEA TLogger 2.1.0.0B0.0.0.0 Backdoor Account / SQL Injection / Disclosure
TBEA TLogger version 2.1.0.0B0.0.0.0 suffers from a backdoor account, resource exhaustion, denial of service, information disclosure, and remote SQL injection vulnerabilities. ------------------------------------------------------------------------------- title| Multiple Vulnerabilities in TBEA...
Horde Groupware Cross Site Scripting
Horde Groupware suffers from persistent cross site scripting and path traversal vulnerabilities. https://blog.evan.lat/posts/CVE-2026-65053/ the blog talks about two vulns that are chainable together. for the sake of brevity ill write up on the stored xss one. in lib/Mime/Status.php, we see a...
Chronicle Wire 2026.8 Class Instantiation
Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation during untyped deserialization. Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation durin...
UltraJSON 5.13.0-6-g733f9e1 Out-Of-Bounds Read
UltraJSON version 5.13.0-6-g733f9e1 suffers from an out of bounds read vulnerability. UltraJSON contains an out-of-bounds read in its native C JSON decoder when processing certain incomplete JSON values supplied through an explicitly length-bounded input buffer. The affected native entry point,...
Nmap 7.99 Memory Exhaustion
Nmap version 7.99 and earlier contain a loop with an unreachable exit condition in the Packet:parseoptions method of nselib/packet.lua. A remote host that is the target of a scan can exhaust the memory of the scanning Nmap process and terminate it by replying with a packet that carries a...
...[ More ]
kamalpanse18 EmpManageX, a Flask-based employee management application, ships hard-coded administrative credentials in its authentication logic. The username admin and the plaintext password admin123 are module-level constants in app.py, compared directly against the values submitted to the...
Zimbra Collaboration Suite 10.1.19 SMTP Command Injection
Zimbra Collaboration Suite versions prior to 10.1.20 contain an OS command injection vulnerability in the optional zimbra-snmp package when SNMP notifications are enabled. This exploit injects a crafted service status message through an unauthenticated SMTP recipient address, causing the SNMP...
...[ More ]
Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events to Java handler methods. During initialization, the framework discovers public methods exposed by the registered handler interfaces and registers those methods as callable wire events. When a...
Tenable Security Center Report Charting Remote Code Execution
This Metasploit module demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated, non-administrative user to achieve code execution as the web service account tns through report generation. This module requires Metasploit: https://metasploit.com/download Current...
Tenable Security Center SCAP Audit File Command Injection
This is a Metasploit module that demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. This module requires Metasploit: https://metasploit.com/download Current...
Ekushey Project Manager CRM 5.0 Cross Site Scripting
A persistent cross site scripting vulnerability was identified in Ekushey Project Manager CRM version 5.0. The issue was found in the application settings, specifically the Name field. CVE-2026-26211 — Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0...
...[ More ]
This Metasploit module exploits CVE-2026-66066 in Ruby on Rails Active Storage when the application uses the Vips variant processor and accepts untrusted image uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text files accessible to the Rails worker through a PNG...
...[ More ]
This Metasploit module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an...
Langflow 1.10.0 Remote Code Execution
Langflow versions 1.10.0 and below are susceptible to unauthenticated remote code execution. By chaining /api/v1/autologin with /api/v1/validate/code, a remote unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. frozenstringliteral: true This module requires...
SPIP X-Spip-Filtre Unauthenticated Remote Code Execution
This Metasploit module exploits a PHP function-call injection in SPIPs template engine. The analyseresultatskel function extracts the X-Spip-Filtre: ... patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter...
Fluent CMS Cross Site Scripting / Article Deletion
Fluent CMS suffers from cross site scripting and article deletion vulnerabilities. Exploit Title: Fluent-CMS Unauthenticated Stored XSS & Article Deletion Date: 2026-08-22 Exploit Author: Chokri Hammedi Software: https://github.com/nexgen999/Fluent-CMS Vendor: https://github.com/nexgen999 Version...
...[ More ]
Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP Model Context Protocol node configuration. The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint, which accepts arbitrary command and argument configurations for MCP...
Linuxfabrik monitoring-plugins 6.0.0 Server-Side Request Forgery
Linuxfabrik monitoring-plugins versions 6.0.0 and below suffer from a server-side request forgery vulnerability. Exploit Title: Linuxfabrik monitoringplugins6.0.0 - SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/Linuxfabrik/monitoring-plugi...
Duplicati 2.2.0.3 JWT Signing Key Leak Bypass
Duplicati exposes the JWT signing key through a case-sensitive guard bypass in the settings endpoint. A GET request to /api/v1/serversetting/JWTConfig PascalCase bypasses the guard check for "jwt-config", allowing any authenticated user to retrieve the secret. With the extracted SigningKey,...
FFmpeg RIST Protocol Heap Buffer Overflow
FFmpeg versions 4.4 through 9.0 contain a heap buffer overflow vulnerability in the RIST protocol reader when built with librist support. A remote unauthenticated attacker can send oversized RIST payloads to an affected async:rist:// receiver, causing attacker-controlled data to be written beyond...
ipTIME A3004T Remote Code Execution
The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026 and does not filter source IP addresses. A remote attacker can send a crafted EADTYPESENDCMD packet to execute arbitrary commands on the device with root privileges. Exploit Title: ipTIME A3004T - Remote Code Execution Date...
WordPress W3 Total Cache 2.10.4 Arbitrary File Write
WordPress W3 Total Cache plugin versions prior to 2.10.5 contain a path traversal vulnerability in the Disk: Enhanced page cache functionality. An unauthenticated attacker can use specially crafted request paths to escape the cache directory and write indexslash.html into arbitrary existing...
Probo 0.222.2 Insecure Direct Object Reference
Probo versions 0.222.2 and below suffer from an insecure direct object reference vulnerability. Exploit Title: Probo 0.222.2 - IDOR Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/getprobo/probo Software Link: https://github.com/getprobo/probo...
NanaZip 6.5 Denial of Service
NanaZip version 6.5 suffers from a denial of service vulnerability. A crafted .NET single-file bundle triggers an uncaught exception / unbounded allocation in the DotNetSingleFile handler's Extract. Exploit Title: NanaZip 6.5 - DoS Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla...
flyto-core 2.26.7 Arbitrary File Write
flyto-core version 2.26.7 suffers from an arbitrary file write vulnerability. data.csvwrite / data.jsontocsv write caller-supplied paths without calling the validatepathwithenvconfig sandbox guard, escaping FLYTOSANDBOXDIR. Exploit Title: flyto-core 2.26.7 - Arbitrary File Write Date: 2026-07-17...
flyto_core 2.26.7 Server-Side Request Forgery
flytocore versions 2.26.7 and below suffer from a server-side request forgery vulnerability. Exploit Title: flytocore 2.26.7- Server-Side Request Forgery Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/flytohub/flyto-core Software Link:...
D-Link DNS_340L Command Injection
Proof of concept exploit for a remote command injection vulnerability in various D-Link models. Exploit Title: D-Link DNS340L - OS Command Injection Date: 2026-07-16 Exploit Author: Jared Brits K3ysTr0K3R Vendor Homepage: https://www.dlink.com/ Version: DNS-320 v1.00, DNS-320LW v1.01.0914.2012,...
webpack_devserver 5.2.5 Cross Site Request Forgery
webpackdevserver versions 5.2.5 and below suffer from a cross site request forgery vulnerability. Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link:...
PC Man FTP Server 2.0.7 Buffer Overflow
PC Man FTP Server version 2.0.7 buffer overflow exploit with reverse-shell shellcode. Exploit Title: PCMan FTP Server 2.0.7 - Buffer Overflow Google Dork: if applicable Date: 05/18/2025 Exploit Author: Thiago Cunha - A.K.A. Blu3B3@rd Vendor Homepage: http://pcman.openfoundry.org/ Software Link:...
Nodemailer 9.0.0 Arbitrary File Read / Server-Side Request Forgery
Nodemailer versions 9.0.0 and below suffer from arbitrary file read and server-side request forgery vulnerabilities. Exploit Title: Nodemailer 9.0.0 - File Read/ SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/nodemailer/nodemailer Software...
Nmap 7.9.9 Extension Header Integer Underflow
Proof of concept for the IPv6 extension header integer underflow discovered in Nmap version 7.9.9. Exploit Title: Nmap 7.99 - Extension Header Integer Underflow CVE: CVE-2026-58058 Date: 2026-06-29 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author...
...[ More ]
A proof of concept exploit for an unauthenticated PHP object injection vulnerability in WooCommerce Subscriptions versions prior to 9.1.0 when High-Performance Order Storage is enabled. Attacker-controlled data supplied through the User-Agent header can undergo unsafe deserialization during...
...[ More ]
A proof of concept exploit for an unauthenticated remote code execution vulnerability in the Fabrik Joomla component versions prior to 4.6.8. A request-controlled filter eval flag can cause an attacker-supplied filter value to be passed to PHP eval, allowing arbitrary PHP and ultimately shell...
...[ More ]
A proof of concept exploit for an out-of-bounds memory access vulnerability in the QEMU Hyper-V synthetic debugger device. The handlerecvmsg function fails to verify the length returned by cpuphysicalmemorymap before copying a received debug datagram into the mapped region. A guest able to invoke...
Webmin Help Template Authenticated Remote Code Execution
Webmin's help system accepts template variables via query parameters and processes them through the eval function. This allows an authenticated user to execute commands with root privileges. Versions prior to 2.640 appear to be affected. Webmin Help Template Authenticated Remote Code Execution...
Online Food Ordering System 1.0 Shell Upload
Online Food Ordering System version 1.0 suffers from a remote shell upload vulnerability. The upload endpoint /web/admin/updatefood.php accepts files with any extension, including .php, and stores them in the web-accessible directory without renaming or sanitizing the filename. Titles:...
...[ More ]
n8n versions through 2.31.4 and version 2.32.0 contain an authentication bypass vulnerability in Token-Exchange embed login that can allow an attacker possessing a private key trusted by the target configuration to assume an existing user's account. The vulnerable email fallback path trusts an...
Apache Tomcat 11.0.23 RewriteValve Authentication Bypass
A proof of concept exploit for an authentication bypass vulnerability in Apache Tomcat version 11.0.23. The vulnerability exists because RewriteValve rebuilds decoded request URIs using java.net.URLDecoder, causing literal plus characters to be interpreted differently during security constraint...
...[ More ]
A proof of concept exploit for an authorization bypass vulnerability in Grafana version 13.1.3. The vulnerability allows an authenticated Editor to delete a protected alert notification receiver despite lacking the permission required to modify its protected destination fields. The receivers upda...
nginx 1.27.0 MP4 Module Denial of Service
A proof of concept exploit for a denial of service vulnerability in nginx version 1.27.0. A 32-bit integer overflow in the ngxhttpmp4module MP4 processing code can cause an out-of-bounds read when processing a specially crafted MP4 file, resulting in a segmentation fault and termination of the...
Planyo Online Reservation System 3.0 SSRF / Arbitrary File Read
Planyo Online Reservation System versions 3.0 and below suffer from an arbitrary file read vulnerability that is leveraged by a server-side request forgery flaw. Exploit Title: PlanyoOnlineReservationSystem 3.0 - Arbitrary File Read via SSRF Date: 12-07-2026 Exploit Author: Balachandar Gowrisanka...
Metabase 0.63.4 SQL Injection
A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability exists in public shared cards containing field-filter template tags, where a specially structured parameter value can be interpreted by HoneySQL as raw query structure rathe...
SonicWall SMA1000 Server-Side Request Forgery / Remote Command Execution
This Metasploit module exploits a server-side request forgery vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to access the internal Erlang distribution service. After authenticating using the known Erlang distribution cookie, the module invokes os:cmd/1 through Erlang RPC to...
CorgetGpsDget 2_3.2 Command Injection
CorgetGpsDget version 23.2 suffers from a remote command injection vulnerability. Exploit Title: CorgetGpsDget 23.2 - OS Command Injection Date: 2026-07-05 Exploit Author: Bytetobreach Fofa server: "PTTServer" Vendor Homepage: http://corget.com Version: GpsDget 23.2, build 2020-09-01 dget.version...
...[ More ]
A proof of concept exploit for an authentication bypass vulnerability in libssh version 0.12.0. The vulnerability affects servers using GSSAPI key exchange and allows a client possessing a valid Kerberos ticket for any principal in the realm to authenticate as an arbitrary local user. The server...
Blocksy Companion 2.1.46 Shell Upload
Blocksy Companion version 2.1.46 suffers from an unauthenticated arbitrary file upload and double-extension bypass that allows for shell uploads. !/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Autho...
...[ More ]
A proof of concept exploit for a local privilege escalation vulnerability in QEMU Guest Agent version 11.0.3. The vulnerability exists in the guest-ssh-add-authorized-keys handler, where improper handling of symbolic links allows an unprivileged guest user to redirect root-privileged file...
Apache Gravitino 1.2.1 Server-Side Request Forgery
A server-side request forgery vulnerability exists in Apache Gravitino versions 1.0.0 through 1.2.1 via the fetchFileFromUri method in JobManager.java. Exploit Title: Apache Gravitino 1.2.1 - SSRF Google Dork: N/A Date: 2026-07-13 Exploit Author: Ajay Rajpurohit Vendor Homepage:...