Skip to content
Threat Feed
Subscribe

Tag

Exploit-Db

7 briefs RSS
high advisory

Krayin CRM v2.2.x Authenticated Remote Code Execution Exploit

A public exploit (EDB-52629) has been released for Krayin CRM v2.2.x, demonstrating an authenticated remote code execution vulnerability that allows an authenticated attacker to execute arbitrary code on the underlying system, significantly increasing the risk for unpatched deployments of the web application.

Krayin CRM v2.2.x webapps rce exploit-db krayin-crm crm
1t
high advisory

Public Exploit for MCPJam Inspector Remote Code Execution (EDB-52625)

A public exploit (EDB-52625) has been published for the web application MCPJam Inspector, demonstrating a Remote Code Execution vulnerability, significantly elevating the risk for unpatched systems and allowing attackers to execute arbitrary code.

MCPJam Inspector webapps rce exploit-db vulnerability
2t
critical advisory

Flowise 3.1.3 Arbitrary Code Execution Exploit Published

A critical arbitrary code execution vulnerability in Flowise version 3.1.3 and earlier has been publicly disclosed on Exploit-DB, enabling unauthenticated attackers to execute arbitrary commands on unpatched web application instances, leading to full system compromise.

Flowise webapps arbitrary-code-execution exploit-db
2t
high advisory

WordPress Bricks Builder Theme - Unauthenticated RCE (CVE-2024-25600)

An unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2024-25600) exists in the WordPress Bricks Builder Theme up to version 1.9.6, allowing attackers to exploit the 'render_element' endpoint by first extracting a nonce from the page source, then injecting PHP code to execute arbitrary operating system commands on the underlying web server, with a public exploit now available.

PoC Bricks Builder Theme < 1.9.7 +1 wordpress rce webapps exploit-db cve
1r 2t 1c 4i updated
high advisory

KeepInMind 0.8.4.2 - Stored XSS Public Exploit

A public exploit has been published for a Stored XSS vulnerability in KeepInMind version 0.8.4.2, significantly increasing the risk for unpatched installations.

KeepInMind 0.8.4.2 webapps xss vulnerability exploit-db
1t
critical advisory

Windows Defender Race Condition (EDB-52612) Leads to Local Privilege Escalation and AV Bypass

A critical local race condition (EDB-52612) exists in Microsoft Windows Defender's MsMpEng.exe, specifically between its cleanup routine (`MpCleanCallbackFunction`) and Volume Shadow Copy creation, allowing Local Privilege Escalation (LPE) to NT AUTHORITY\SYSTEM and temporary disabling of antivirus protection through a use-after-free vulnerability, with a public exploit demonstrating the risk.

Windows Defender Antivirus local-privilege-escalation race-condition windows-defender exploit-db vulnerability endpoint
1t 3i
high advisory

Flowise < 3.0.5 Missing Authentication Vulnerability Exploitable

A missing authentication vulnerability in Flowise versions prior to 3.0.5 allows attackers to perform critical functions without authentication, and a working exploit is publicly available on Exploit-DB.

Flowise authentication bypass web application exploit-db
2r 1t