CVE-2021-41078

CVE-2021-41078 nameko의 YAML 역직렬화로 인한 임의 코드 실행 NVD 설명 Nameko 2.13.0 이하 버전은 설정 파일을 역직렬화할 때 임의 코드 실행을 수행하도록 속일 수 있습니다. 데모 설정 1. Dockerfile에서 이미지 빌드 docker build -t cve-2021-41078 . 2. 새 컨테이너에서 python main.py 실행 docker run -it --rm cve-2021-41078 /etc/passwd 출력 root:x:0:0:root:/root:/bin/bash...

CVE-2026-33032

CVE-2026-33032 セーフチェック（nginxステータスの読み取り） python3 main.py http://target:9000 --tool nginxstatus 設定一覧 python3 main.py 10.0.0.50 --tool nginxconfiglist 破壊的デモ（書き込み + リロード） python3 main.py http://target:9000 \ --tool nginxconfigadd \ --payload poc.conf \ --content 'server listen 8443; return 200...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs는 GitHub의 개인 버전과 유사한 경량의 자체 호스팅 Git 서비스로, 저사양 서버에서도 쉽게 실행되도록 설계되었습니다. CVE-2025-8110 취약점은 공격자가 심볼릭 링크를 사용하여 경로 제한을 우회할 수 있게 하는 심각한 보안 결함입니다. .api/config를 가리키는 악의적인 링크를 업로드하면 공격자는 gogs API를 사용하여 sshCommand 매개변수가 포함된 악성 구성 파일을 삽입하고 호스트 서버에서 RCE를 달성할 수 있습니다. 사용법 1. 이 저장소를 로...

CVE-2023-51385-

안전하지 않은 /.ssh/config를 통한 RCE SSH.ProxyCommand에서 터널 및 연결 프록시를 위해 %h, %p와 같은 토큰을 사용하는 것은 꽤 일반적입니다. 취약한 설정 host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p 참고: 처음 평가에서는 '%h단일 인용부호를 사용하면 이를 피할 수 있을 것이라고 생각했지만, 다음과 같은 것으로는 여전히 취약한 것 같습니다: ssh://echo helloworld...

CVE-2023-27524

CVE-2023-27524 Apache Superset 인증 우회 CVE-2023-27524 참조 https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/...

Cisco-Smart-Exploit

Cisco-Smart-Exploit Cisco SmartInstall エクスプロイト CVE-2018-0171 C. Papathanasiou PoC から触発されました この Python 3 スクリプトは、SmartInstall を実行している Cisco デバイスのポート 4786 を使用して CVE-2018-0171 を悪用します。このエクスプロイトを使用すると、攻撃者はペイロードを作成し、Cisco デバイスに送信して、running-config ファイルの内容を抽出できます。 Cisco Smart Exploit スクリプトは次のことが可能です: 抽出...

CVE-2026-12264

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

CVE-2026-12264 Authenticated File Write via HA Failover Config Upload leads to RCE

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

CVE-2026-12264 Authenticated File Write via HA Failover Config Upload leads to RCE

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

EUVD-2026-88226

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

CVE-2026-12264

Zohocorp ManageEngine DDI Central versions prior to 6201 are vulnerable to an Arbitrary file write flaw. This vulnerability occurs during the HA Failover Config sync upload process, which can be leveraged by an authenticated user to achieve remote code execution (RCE) . No specific exploit detail...

EUVD-2026-88217

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2024-32004

tmp 저장소를 생성하고 uploadpack.allowfilter를 true로 설정 git init tmp git -C tmp config uploadpack.allowfilter 1 tmp 저장소에서 evil 복제 git clone --filter=blob:none --no-local --no-checkout tmp evil rm -rf tmp 원격 필터 스크립트 구성 git -C evil config remote.origin.uploadpack "./fake-upload-pack" 악성 스크립트 실행 git pull...

CVE-2026-75616

CVE-2026-75616 TP-Link Archer C20 v6 Web管理インターフェースにおける認証済みOSコマンドインジェクション。 BPA WAN設定値は適切な無害化なしにsystemに渡されるため、隣接ネットワーク上の認証済み管理者がrootとしてコマンドを実行できる。 Daniil Gordeev totekuh によって発見および報告されました。 影響を受けるバージョン Archer C20 v6 EUファームウェア 0.9.1 Build 260811 より前 Archer C20 v6 USファームウェア 0.9.1 Build 260812 より前 Arche...

EUVD-2026-88047

A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be...

EUVD-2026-88049

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-12264: Unrestricted Upload of File with Dangerous Type

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...

CVE-2026-100884

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...