xss_vulnerability_challenges

XSS 漏洞场景（挑战） 本仓库是一个 Docker 化的 PHP 应用程序，包含了一些 XSS 漏洞挑战。 挑战背后的思路包括： JavaScript 验证绕过 HTML 实体绕过 WAF 绕过 黑名单验证绕过 基础 XSS 验证绕过 利用双层编码绕过 WAF 以利用 XSS 通过绕过转义字符利用 XSS 使用 Docker 快速开始 使用 Docker Hub（最快）： 1. 要访问这些挑战，你需要安装 Docker。 2. 运行以下命令从 Docker Hub 拉取并运行镜像： sudo docker run -d -p 9003:80...

CVE-2026-5718-Lab

CVE-2026-5718 Laboratório Docker Local Laboratório Docker local apenas local que compara a versão vulnerável e a corrigida para CVE-2026-5718 , que afeta o plugin WordPress Drag and Drop Multiple File Upload for Contact Form 7. Este laboratório demonstra a diferença entre a versão vulnerável...

CVE-2020-26258

Descrizione XStream è una libreria Java per serializzare oggetti in XML e viceversa. In XStream precedente alla versione 1.4.15, è presente una vulnerabilità di Server-Side Forgery Request che può essere attivata durante l'unmarshalling. La vulnerabilità potrebbe consentire a un attaccante remoto...

CVE-2019-19576

class.upload.php = 2.0.3 Beliebiger Datei-Upload Autor - Jinny Ramsmark Betroffener Anbieter - Verot.net Betroffenes Produkt - class.upload.php = 2.0.3 Getestet auf frisch installiertem Ubuntu 19.10 mit PHP7.3 und Apache/2.4.38 Insbesondere Debian/Ubuntu erwies sich als anfällig, da sie die...

CVE-2020-8840

CVE-2020-8840: Vulnerabilità di esecuzione remota di codice in FasterXML/jackson-databind 0x00 Introduzione root@kitploit: jackson-databind è una libreria di elaborazione JSON appartenente al gruppo di progetti FasterXML. 0x01 Panoramica della vulnerabilità root@kitploit: Il 19 febbraio, NVD ha...

CVE-2026-1337-AI-Coding-Assistant-Prompt-Injection-to-Sandbox-Escape

CVE-2026-1337 – Iniezione di prompt nell'assistente di codifica IA verso RCE 📖 Panoramica Una vulnerabilità di iniezione del prompt in un bot di revisione del codice basato su IA consente a un attaccante di iniettare comandi shell arbitrari manipolando il suggerimento di "fix" del bot. Il sanitiz...

CVE-2017-1000486

CVE-2017-1000486 Este é um PoC do CVE-2017-1000486 com algumas cargas úteis para contornar verificações lexicográficas de blacklist em funções padrão usadas para obter RCE getClass, exec, etc.. e para recuperar o segredo do primefaces através de Padding Oracle para ser o menos ruidoso possível na...

monstra_cms-3.0.4--getshell

monstracms-3.0.4--getshell monstracms-3.0.4-upload getshell CVE- 2018-17418 Análise de código Code analysis: Na linha 150 de monstra\plugins\box\filesmanager\ filesmanager.admin.php, existe uma variável forbiddentypes que serve como restrição de lista negra; continue a seguir essa variável. Na...

CVE-2025-51458-exp

CVE-2025-51458-exp SQL Injection pre-autenticazione in DB-GPT --sql "SELECT VERSION" Dump tables python3 exp.py http://target:5670 --dump-tables Dump schema python3 exp.py http://target:5670 --dump-db DuckDB bypass python3 exp.py http://target:5670 --duckdb-bypass --sql "SELECT...

CVE-2025-9223

Applications Manager - PoC di Bypass dell'Azione di Esecuzione Programmi 📖 Descrizione Questo repository contiene una Prova di Concetto PoC che dimostra una vulnerabilità di esecuzione di comandi nella funzione "Execute Program Action" di ManageEngine Applications Manager. 🔍 Dettagli della...

fastjson-1.2.61-RCE

fastjson-1.2.61-RCE PS: Offiziell wurde in https://github.com/alibaba/fastjson/blob/master/src/main/java/com/alibaba/fastjson/parser/ParserConfig.java 0x7bddd363ad3998c6L d.h. 1.2.61 8925522461579647174 0x7bddd363ad3998c6L org.apache.commons.configuration.JNDIConfiguration zur Blacklist...

CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE

CVE-2025-69906: Monstra CMS 3.0.4 Upload Arbitrário de Arquivo para RCE Autor : David PS Abraham Data : 5 de fevereiro de 2026 Severidade : Crítica - Execução Remota de Código CVSS 8.8+ CWE : 434 Upload Irrestrito de Arquivo com Tipo Perigoso Descrição da Vulnerabilidade O plugin Files Manager do...

CVE-2020-10673

भेद्यता विवरण हाल ही में, AsiaInfo सुरक्षा नेटवर्क आक्रमण और रक्षा प्रयोगशाला ने ट्रैक किया कि jackson-databind ने एक JNDI इंजेक्शन ब्लैकलिस्ट क्लास को अपडेट किया है। यदि प्रोजेक्ट पैकेज में इस क्लास का jar पैकेज मौजूद है और JDK संस्करण इंजेक्शन संस्करण को पूरा करता है, तो JNDI इंजेक्शन का उपयोग...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to remote command execution in the CodeNode component of its AI Flow module. The component supports Groovy script execution, and while the SecurityCheck class applies a blacklist to intercept dangerous calls, the dynamic nature of Groovy allows the blacklist to be c...

EUVD-2026-66747

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

EUVD-2026-66702

The front-end interface /cms/category/list of MCMS =6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker $size without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist...

CVE-2026-68000

MCMS versions up to 6.2.0 contain an unauthenticated SQL injection in the front-end interface /cms/category/list . The size parameter is directly concatenated into the SQL LIMIT clause via FreeMarker ${size} without parameterization or binding. The built-in SqlInjectionUtil uses a regular-express...

CVE-2026-75514

In BunkerWeb versions prior to 1.6.13, the blacklist, greylist, and antibot modules in blacklist.lua, greylist.lua, and antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without calling get_ips to verify the hostname resolves to the client IP. An attacker...

EUVD-2026-63542

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORERDNS,...

CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...