SiYuan - SQL Execution

SiYuan = v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleRead...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 jenkins-cli Hemos visto una fuga de archivos / RCE de Jenkins CVE-2024-23897 explotada en la naturaleza y logramos reproducirla. Si tu Jenkins permite usuarios anónimos o registro de usuarios, actualízalo inmediatamente a la última versión. java -jar jenkins-cli.jar ...

drupal-cve-2026-9082-checker

DRUPAL CVE-2026-9082 COMPROBADOR Drupal CVE-2026-9082 Comprobador de Inyección SQL Ciega Instalación git clone https://github.com/N45HT/drupal-cve-2026-9082-checker.git cd drupal-cve-2026-9082-checker pip install -r requirements.txt Referencias https://vulners.com/cve/CVE-2026-9082...

CVE-2025-47812-poc

CVE-2025-47812 Exploit de Ejecución Remota de Código RCE en Wing FTP Server CVE-2025-47812 📌 Crédito : Vulnerabilidad descubierta por Julien @MrTuxracer. Esta implementación de PoC se basa en su investigación original. Este repositorio alberga un exploit en Python para la vulnerabilidad de...

CVE-2025-47812

🚀 Wing FTP Exploit - CVE-2025-47812 Exploit mejorado para Wing FTP Server CVE-2025-47812 - Unauthenticated Remote Code Execution RCE 🔧 Instalación Clona este repositorio y entra en el directorio: git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 pip install -r...

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

EUVD-2026-60585

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers...

sccm-http-looter

SCCM HTTP Looter Cómo funciona Los puntos de distribución DP de SCCM son los servidores que Microsoft SCCM utiliza para alojar todos los archivos usados en instalaciones de software, parches, implementaciones de scripts, etc. Por defecto, estos servidores permiten el acceso mediante SMB TCP/445 y...

EUVD-2026-57813

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering...

EUVD-2026-57809

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem...

POC-2020-8559

POC-2020-8559 Exploit para CVE-2020-8559. Robamos todas las conexiones al kubelet usando iptables y luego reescribimos las respuestas 101 o 302 a 307. Los 101 son para versiones modernas de Kubernetes, los 302 para las más antiguas. No tenemos acceso al certificado x509 del kube-apiserver, por lo...

Quest KACE System Management Appliance 8.0.318 - Remote Code Execution

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system. id: CVE-2018-11138 info: name: Quest KACE System Management Appliance 8.0.318 - Remote Code Executi...

DRUPAL-CONTRIB-2026-174

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended t...

SUSE CVE-2026-72798

SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases ...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-63646

CordysCRM , an open-source AI-powered CRM supporting private deployment, exposed the GET /mcp/form/config/{formKey} endpoint to unauthenticated access prior to version 1.7.2 . The root cause is twofold: ShiroFilter.addPublicPathFilters marks all /mcp/** paths as anonymous, and the McpController l...

CVE-2026-91996

lamp-cloud through version 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, leaving the /defGenProject/anno/getProperties endpoint unauthenticated. An unauthenticated attacker can send a POST request to this endpoint to retrieve the server's full JVM system property map , inclu...

PT-2026-91936

lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath...

CVE-2026-91081

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-90940

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...