drupal-cve-2026-9082-checker

DRUPAL CVE-2026-9082 チェッカー Drupal CVE-2026-9082 ブラインドSQLインジェクションチェッカー インストール git clone https://github.com/N45HT/drupal-cve-2026-9082-checker.git cd drupal-cve-2026-9082-checker pip install -r requirements.txt 参照 https://vulners.com/cve/CVE-2026-9082 https://cwe.mitre.org/data/definitions/89.html...

SiYuan - SQL Execution

SiYuan = v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleRead...

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 jenkins-cli Hemos visto una fuga de archivos / RCE de Jenkins CVE-2024-23897 explotada en la naturaleza y logramos reproducirla. Si tu Jenkins permite usuarios anónimos o registro de usuarios, actualízalo inmediatamente a la última versión. java -jar jenkins-cli.jar ...

EUVD-2026-60585

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers...

sccm-http-looter

SCCM HTTP Looter 工作原理 SCCM 分发点（DP）是 Microsoft SCCM 用于托管软件安装、补丁、脚本部署等所用全部文件的服务器。默认情况下，这些服务器允许通过 SMB（TCP/445）和 HTTP/S（TCP/80 和/或 TCP/443）进行访问，并且需要某种类型的 Windows 身份验证（即 NTLM）。 当前的 SCCM DP 文件提取工具依赖于浏览 SMB 共享来收集文件的能力。 CMloot cmloot 然而，组织限制内部网络服务器上的入站 SMB 访问并不少见，并且阻止来自互联网的入站 SMB 访问也是标准做法。另一方面，HTTP/S...

EUVD-2026-57813

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering...

EUVD-2026-57809

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem...

POC-2020-8559

POC-2020-8559 CVE-2020-8559的利用。我们使用iptables劫持所有到kubelet的连接，然后将101或302响应重写为307。101用于现代Kubernetes版本，302用于较旧版本。 我们无法访问kube-apiserver的x509证书，因此kubelet webhook认证可能成为问题。使用这个kubelet配置片段就没有问题，它基本上重新启用了旧式的kubelet利用： authentication: anonymous: enabled: true authorization: mode: AlwaysAllow...

CVE-2025-47812-poc

CVE-2025-47812 Wing FTP Server リモートコード実行 RCE エクスプロイト CVE-2025-47812 📌 クレジット : 脆弱性は Julien @MrTuxracer によって発見されました。 この PoC 実装は彼らのオリジナル研究に基づいています。 このリポジトリは、Wing FTP Server のリモートコード実行 RCE 脆弱性 CVE-2025-47812 に対する Python エクスプロイトをホストしています。この重大な欠陥により、攻撃者は影響を受ける Wing FTP Server...

CVE-2025-47812

🚀 Wing FTP Exploit - CVE-2025-47812 Wing FTP Server CVE-2025-47812 の改良版エクスプロイト - 未認証リモートコード実行 RCE 🔧 インストール このリポジトリをクローンし、ディレクトリに移動します: git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 pip install -r requirements.txt または、CVE-2025-47812.py スクリプトをダウンロードして実行するだけです。 🚀 使い方...

Quest KACE System Management Appliance 8.0.318 - Remote Code Execution

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system. id: CVE-2018-11138 info: name: Quest KACE System Management Appliance 8.0.318 - Remote Code Executi...

DRUPAL-CONTRIB-2026-174

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended t...

SUSE CVE-2026-72798

SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases ...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-63646

CordysCRM , an open-source AI-powered CRM supporting private deployment, exposed the GET /mcp/form/config/{formKey} endpoint to unauthenticated access prior to version 1.7.2 . The root cause is twofold: ShiroFilter.addPublicPathFilters marks all /mcp/** paths as anonymous, and the McpController l...

CVE-2026-91996

lamp-cloud through version 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, leaving the /defGenProject/anno/getProperties endpoint unauthenticated. An unauthenticated attacker can send a POST request to this endpoint to retrieve the server's full JVM system property map , inclu...

PT-2026-91936

lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath...

CVE-2026-91081

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-90940

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...