269376 matches found
cve-2022-41352-zimbra-rce
Questo repository non contiene un README...
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
Summary verifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explic...
CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-
CVE-2026-20253 - Splunk Enterprise Pre-Auth RCE PoC CVE-2026-20253 - Splunk Enterprise Pre-Auth RCE PoC ⚠️ WARNUNG : Dieses Skript dient nur zu Bildungs- und Testzwecken in autorisierten Umgebungen. Die unbefugte Nutzung ist verboten und kann illegal sein. 📋 Beschreibung...
EUVD-2026-65547
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...
CVE-2026-55546 QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...
CVE-2026-55546 QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...
CVE-2026-55546
QWED-MCP (a deterministic verification gateway for MCP) is affected by a Critical (CVSS 9.8) remote code execution vulnerability in verify_math_expression() within src/qwed_mcp/engines/math_engine.py. Attacker-controlled expression strings are passed directly to SymPy's parse_expr() without restr...
CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE -orange 📋 Descrição CVE-2024-21182 é uma vulnerabilidade de injeção JNDI não autenticada que afeta o componente Core do Oracle WebLogic Server. Permite que um atacante remoto,...
CVE-2026-79774 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...
CVE-2026-79774
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape in System\Twig\SecurityPolicy. Authenticated backend users with template-editing permissions can bypass sandbox restrictions by exploiting method forwarding through Eloquent models and query builders (e.g., save...
EUVD-2026-65532
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...
CVE-2026-79774 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...
CVE-2025-50165-x64-Exploit
CVE-2025-50165 Componente Grafico Windows RCE x64 Esecuzione remota di codice critica tramite JPEG malevolo – Windows 11 24H2 senza patch CVSS 9.8 – Nessun privilegio, nessuna interazione richiesta root@kitploit: CVE-2025-50165 - windowscodecs.dll dereferenza di puntatore non attendibile Scoperto...
Watchguard-RCE-POC-CVE-2022-26318
Watchguard-RCE-POC-CVE-2022-26318 تم تحديث PoC لـ Watchguard CVE-2022-26318 ليعمل مع Python3.12 نظرًا لأن ssl.wrapsocket مهمل. PoC مأخوذ أصلاً من https://github.com/h3llk4t3/Watchguard-RCE-POC-CVE-2022-26318/blob/main/POCwg.py...
CVE-2026-55534 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...
react2shell-rce-autobot
🔍 React2Shell Dork Scanner 🚨 Über die Schwachstelle React2Shell ist eine kritische Remote Code Execution RCE -Schwachstelle, die folgende Komponenten betrifft: Ziel| Verwundbare Versionen ---|--- ⚛️ react-server-dom-webpack| 19.0.0, 19.1.0, 19.1.1, 19.2.0 ⚛️ react-server-dom-turbopack| 19.0.0,...
CVE-2022-1329
CVE-2022-1329 Das Elementor Website Builder Plugin für WordPress ist anfällig für die unbefugte Ausführung mehrerer AJAX-Aktionen aufgrund einer fehlenden Berechtigungsprüfung in der Datei /core/app/modules/onboarding/module.php, die es Angreifern ermöglicht, Websitedaten zu ändern und bösartige...
CVE-2022-29464
WSO2 RCE CVE-2022-29464 exploit e writeup. Dettagli CVE-2022-29464 è una grave vulnerabilità in WSO2. La vulnerabilità è un caricamento arbitrario di file non autorizzato e senza restrizioni che consente a utenti non autorizzati di caricare file JSP dannosi sui server WSO2 e ottenere l'esecuzione...