Lucene search
+L

298 matches found

Kitploit
Kitploit
added 2026/09/14 2:13 a.m.5 views

cve-2017-5941-poc-docker-lab

CVE-2017-5941 — node-serialize Untrusted Deserialization RCE PoC ⚠️ For lab / self-assessment only. Use only on systems you own or are authorized to test. This repository provides: A minimal PoC script to reproduce CVE-2017-5941 against a vulnerable Node.js app that uses node-serialize = 0.0.4. Tw...

9.8CVSS8.1AI score0.61025EPSS
SaveExploits7
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.31 views

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

9.8CVSS8.6AI score0.895EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/09/13 4:09 p.m.8 views

CVE-2026-44963

CVE-2026-44963 — Veeam备份与复制远程代码执行漏洞 由SentinelX 维护的研究仓库 — 仅用于授权的安全测试和防御目的。 概述 字段| 详情 ---|--- CVE ID| CVE-2026-44963 供应商| Veeam 产品| Backup & Replication 受影响版本| 12.3.2.4854(所有 v12 构建版本) 修复版本| 12.3.2.4854 CVSS v4 评分| 9.4 — 严重 CVSS v3 评分| 8.8 — 高危 CWE| CWE-502(不可信数据反序列化) 发现者| Sina Kheirkhah @ WatchTow...

9.4CVSS9AI score0.02351EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/13 4:01 p.m.4 views

cotonti-commentswidget-poc

PoC de inyección de objetos PHP en Cotonti CommentsWidget Prueba de concepto local segura para el problema de inyección de objetos PHP identificado en la implementación de CommentsWidget de Cotonti. Vulnerabilidad Proyecto: Cotonti Componente afectado: plugins/comments/inc/CommentsWidget.php CWE:...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 7:28 p.m.8 views

CVE-2025-64512-pdfminer-PoC

CVE-2025-64512 — PoC de deserialización de CMapDB en pdfminer.six Prueba de concepto de una vulnerabilidad de deserialización en pdfminer.six que conduce a la ejecución de código arbitrario al analizar un PDF manipulado. PROPÓSITO / AVISO LEGAL Este repositorio se proporciona solo con fines...

8.6CVSS7.4AI score0.00312EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/12 2:21 a.m.5 views

CVE-2026-50522

🛡️ CVE-2026-50522 — Microsoft SharePoint RCE Investigation Critical SharePoint Deserialization Vulnerability Under Active Exploitation Created by Pratik Chhetri Report Date: 2026-07-27 📌 Executive Snapshot...

9.8CVSS7.8AI score0.854EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/11 2:58 p.m.7 views

CVE-2026-68771_exploit

CVE-2026-68771 — RCE no autenticado por deserialización de pickle en ComfyUI Ejecución remota de código no autenticada en ComfyUI a través del nodo LoadTrainingDataset. LoadTrainingDataset.execute carga los shards del dataset desde el directorio de salida del servidor con torch.loadf y...

9.8CVSS5.8AI score0.00781EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/10 3:09 p.m.13 views

CVE-2026-20131-Post-Incident-Written-Report

CVE-2026-20131-Informe-Escrito-Post-Incidente Este informe post-incidente analiza la explotación de CVE-2026-20131, una vulnerabilidad crítica de Ejecución Remota de Código RCE no autenticada de día cero en Cisco Secure Firewall Management Center FMC. El documento cubre el vector de intrusión...

10CVSS8.4AI score0.33379EPSS
SaveExploits4
Nuclei
Nuclei
added 2026/09/09 2:52 a.m.289 views

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

10CVSS9.4AI score0.99941EPSS
SaveExploits6References5
Kitploit
Kitploit
added 2026/09/08 11:51 p.m.6 views

CVE-2025-53770

CVE-2025-53770 Detection Project A comprehensive vulnerability detection toolkit for identifying systems vulnerable to CVE-2025-53770 CWE-502: Deserialization of Untrusted Data. 🔍 Overview This project provides enterprise-ready detection scripts to identify and assess systems potentially vulnerab...

9.8CVSS8AI score0.99998EPSS
SaveExploits42
Kitploit
Kitploit
added 2026/09/08 1:15 p.m.4 views

CVE-2025-68664-LangGrinch-PoC

!CWEhttps://img.shields.io/badge/CWE--502-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96-informational?style=for-the-badge&logo=owasp&logoColor=whit...

9.3CVSS7.8AI score0.43415EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/08 12:20 p.m.5 views

langgrinch-cve-2025-68664-analysis

LangGrinch漏洞分析:CVE-2025-68664 概述 本仓库包含一份关于CVE-2025-68664(又名LangGrinch)的技术报告,该漏洞是影响LangChain Core的反序列化注入漏洞。 报告阐述了漏洞背景、根本原因、利用流程、威胁模型、缓解策略以及对基于LLM的应用的实际安全影响。 涵盖主题 LangChain序列化与反序列化 不安全的反序列化 / CWE-502 LLM应用安全 作为传递路径的提示注入 秘密暴露风险 STRIDE威胁建模 缓解措施与安全编码实践 报告 完整报告请见: LangGrinch CVE-2025-68664报告 关键要点...

9.3CVSS7.9AI score0.43415EPSS
SaveExploits5References1
EUVD
EUVD
added 2026/08/28 7:12 p.m.18 views

EUVD-2026-67870

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

9.3CVSS6.3AI score0.00498EPSS
SaveExploits0References5
Snyk
Snyk
added 2026/08/20 12:00 a.m.19 views

Deserialization of Untrusted Data

Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JobParameterDeserializer. An attacker can execute arbitrary code by...

9.8CVSS6.1AI score0.00292EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.24 views

Deserialization of Untrusted Data

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...

9.2CVSS6.1AI score0.00478EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/19 3:02 p.m.10 views

Security Bulletin: IBM Terracotta is affected by Logback vulnerabilities that could allow deserialization of untrusted data resulting in object injection

Summary IBM Terracotta uses Logback for logging purposes within the product. Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit...

6.3CVSS5.9AI score0.0037EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/19 2:21 p.m.10 views

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent

Summary Vulnerabilities in IBM SDK Java Technology Edition that is shipped as part of agent framework in ITCAM for Applications WebSphere MQ Monitoring Agent. CVEs: CVE-2026-41254, CVE-2026-47057, CVE-2026-47058, CVE-2026-47063 and CVE-2026-8400 Vulnerability Details CVEID:CVE-2026-47057...

9.8CVSS5.5AI score0.00463EPSS
SaveExploits1Affected Software1
NVD
NVD
added 2026/08/18 5:17 p.m.10 views

CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

7.5CVSS0.00317EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/18 4:27 p.m.30 views

CVE-2026-63337 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

7.5CVSS0.00317EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/18 12:00 a.m.23 views

PT-2026-77211

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

7.5CVSS5.3AI score0.00317EPSS
SaveExploits0References6
Rows per page
Query Builder