CVE-2022-39952

CVE-2022-39952 Fortinet FortiNACに影響するCVE-2022-39952のPOC このエクスプロイトのデフォルト設定は、リバースシェルを作成するcronジョブを書き込みます。環境に合わせてpayloadファイルを必ず変更してください。 技術分析 脆弱性の根本原因分析と侵害指標については、弊社ブログをご覧ください: https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs 概要...

EUVD-2026-87471

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

GestioIP - Reflected Cross-Site Scripting

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ipdojob request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions. id: CVE-2024-50857 info: name: GestioIP - Reflected Cross-Site Scripting author:...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Ray < 2.52.0 - Remote Code Execution

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...

MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/admin/company/index.php?view=edit&id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site...

Complete Online Job Search System 1.0 - Cross-Site Scripting

Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch. id: CVE-2022-29316 info: name: Complete Online Job Search System 1.0 - Cross-Site Scripting author: arafatansari severity: high description: | Complete Online Job Search System 1.0...

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

XXL-JOB v2.2.0 — Stored Cross Site Scripting

Multiple cross-site scripting XSS vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 AppName and 2AddressList parameter in JobGroupController.java file. id: CVE-2020-23814 info: name: XXL-JOB v2.2.0 — Stored Cross Site Scripting author:...

WordPress Job Portal < 2.0.6 - SQL Injection

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape the city parameter before using it in a SQL statement,leading to a SQL injection vulnerability that is exploitable by unauthenticated users. This vulnerability can be used to extractsensitive data from the database or...

xxl-job

xxl-job エグゼキュータ RESTful API 未認証アクセス RCE 実行ログConsoleを利用することでコマンド実行成功の結果を取得できます： 例： /joblog/logDetailPage?id=xxxx JDK環境変数の確認 root@kitploit: String var3 = System.getProperties.toString; System.out.printlnvar3; コマンド実行 /jobcode?jobId=x root@kitploit: import com.xxl.job.core.log.XxlJobLogger; import...

CVE-2022-0540-RCE

Atlassian Jira Seraph 認証バイパス RCE（CVE-2022-0540） 英語 • 中国語 エクスプロイト詳細 著者のブログで見られるように、Atlassianは影響を受けるプラグインの長いリストを提供しました（その大部分は偽陽性でした）。著者は実際に影響を受けるいくつかのプラグインを挙げています。 指示された条件に従い、WBS Gantt-Chart for Jiraの公式ドキュメントと組み合わせて 基本的には、ジョブスケジューラモジュール Task の Beanshell Script を利用した RCE です。エクスプロイトの詳細は以下の通りです。 1...

patchy

Patchy GCP OS 패치 관리를 악용한 자동화된 측면 이동 및 지속성 도구입니다. 기반: 블로그 포스트. Patchy는 두 가지 주요 모드측면 이동 및 지속성로 구성됩니다. 지속성 모드는 유효한 서비스 계정 자격 증명을 사용하여 패치 작업 또는 배포를 생성합니다. 측면 이동 모드는 프로젝트 내 모든 컴퓨트 인스턴스에 대한 액세스를 시도합니다. 사용하려면 메타데이터 API를 사용할 수 있는 GCP 환경 내에 있어야 합니다. 측면 이동 모드는 공격적인 시도 없이 익스플로잇 가능 여부를 확인할 수 있는 모드도 제공합니다환경이...

Mailcow-CVE-2022-31138

Mailcow CVE-2022-31138 Mailcow の RCE および Domain Admin 権限昇格。この脆弱性で動作するように CVE-2022-31245 の POC を変更することができます。 報告および修正: 2022-06 コードインジェクション、RCE タイプ: コードインジェクション CWE-94、RCE、ドメイン乗っ取り 影響を受けるバージョン: 2019 - 2022-06a 最近のすべての Mailcow バージョンには、システムの一般ユーザーが「Sync Job」機能を悪用して、imapsync の任意の正規表現フィールドへの perl...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

CVE-2026-4480-PoC

CVE-2026-4480：Samba print-command（%J）インジェクション PoC 重要 — 最初に必ずお読みください： このリポジトリおよび exploit.py は教育および研究目的のみ 提供されています。明示的な書面による許可 がないシステム、ネットワーク、またはサービスに対してこのコードを使用しないでください 。許可されていないコンピュータシステムへのアクセスは違法かつ非倫理的です。このコードを使用することにより、適用される法律および機関のポリシーに従うことに同意したものとみなします。 Samba...

CVE-2026-84862

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...

CVE-2026-84862

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization within the Quartz JDBC job store (CWE-502). An authenticated attacker could exploit this flaw to execute arbitrary code on the affected system. IBM has addressed this vulnerability in an update; customers are encouraged t...

CVE-2026-84862 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system...