CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server und Data Center - Command Injection Schwachstelle CVE-2022-36804 In betroffenen Versionen von Atlassian Bitbucket Server und Data Center existiert eine Command Injection Schwachstelle in mehreren API-Endpunkten, bei der ein Angreifer mit Zugriff auf ein...

FortiWeb-CVE-2025-52970-Authentication-Bypass

🚨 FortiWeb Authentifizierungsumgehung → Remote Code Execution 📌 Übersicht Dieses Repository demonstriert eine Authentifizierungsumgehung in FortiWeb , die genutzt werden kann, um Remote Code Execution RCE zu erreichen. Der Exploit nutzt einen verwundbaren Endpunkt, um SQL-Payloads zu injizieren,...

Exploit for CVE-2026-105314

Papermerge-core: Authenticated Path Traversal to Arbitrary Fil...

wp2shell

CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

Apache-APISIX-CVE-2022-24112

Apache APISIX Remote Code Execution CVE-2022-24112 Exploit Zusammenfassung Ein Angreifer kann das batch-requests-Plugin missbrauchen, um Anfragen zu senden, die die IP-Einschränkung der Admin-API umgehen. Eine Standardkonfiguration von Apache APISIX mit Standard-API-Schlüssel ist anfällig für...

CVE-2023-48084

CVE-2023-48084 Behebt fehlerhafte Syntax im POC, hauptsächlich falsche Importe und falsche Verweise auf API-Funktionen. Automatisiert den Abruf des API-Tokens, speichert das Token als Variable und leitet es in den reparierten POC weiter. https://github.com/Hamibubu/CVE-2023-48084 Falls dies aus...

CVE-2022-22947-

CVE-2022-22947 Spring Cloud Gateway Actuator API - Esecuzione di comandi tramite injection di espressioni SpEL CVE-2022-22947 - Iniezione di Godzilla Memory Shell Chiave predefinita: pass base64 Nota: il codice non pulisce la parte di routing, puliscila manualmente.. Ambiente di test:...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

CVE-2026-105307

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

Improper Privilege Management

Apache Syncope is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in certain user workflow configurations, which allows an authenticated user to grant themselves defined Roles through a REST API and gain their associated entitlements,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Net: tun: Unlinking the NAPI from the device upon destruction. Syzbot identified a race condition between the tun file and the device destruction process. NAPIs reside in the structtunfile structure, and this structure may be...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Networking. The supported versions affected by this vulnerability include Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 90.0.4430.72, using the "after free" mechanism in the Network API of Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension...

Astra Linux – Vulnerability in docker.io-app

BuildKit is a toolkit for converting source code into build artifacts in an efficient, expressive, and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to...

CVE-2026-5027

Dieser Beitrag ist ein Forschungartikel, der von EQSTLab veröffentlicht wurde. Dank anYahia Hamza, der diese Schwachstelle gemeldet und analysiert hat. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Beschreibung CVE-2026-5027 : Langflow Arbitrary File Write...

ai-kubernetes-helm-chart-security

KI auf Kubernetes: Helm-Chart-Sicherheitsstandards Nachweise Dieses Repository enthält die Daten und Nachweise hinter dem technischen Bericht von Sorami „KI auf Kubernetes: 10 von 14 Helm-Charts werden ohne API-Authentifizierung ausgeliefert" Version 1.2. Den Bericht hier lesen:...

CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...