CVE-2023-24329-Exploit

简介 URL 解析函数专注于将 URL 字符串拆分为其组成部分，或将 URL 组成部分组合成 URL 字符串。 urllib.parse.urlparse 简单来说 ，urllib.parse 用于解析 URL，我们可以通过在 URL 前添加空格来绕过它。这发生在 Python 3.11.4 及更早版本中。 PoC 让我们分解 example.py 以下是一组你不应访问的网站： blockedlist = "http://example.com/", "http://example2.com/" 此函数检查网站是否在阻止列表中，如果在阻止列表中，则应返回 URL Blocked def...

EXPLOIT-CVE-2026-40901

DataEase——通过四漏洞链实现未认证 RCE（CVE-2026-40901 及相关漏洞） 认证绕过 → JDBC 黑名单绕过（任意文件读取）→ SQL 注入 → Quartz 中的 Java 反序列化 → 以root 身份远程代码执行。 自带完整的本地实验环境（Docker）+ 可用的 PoC。已在 DataEase v2.10.21 中修复。 DataEase 是一个流行的开源 BI / 数据可视化平台（Java / Spring Boot）。≤ v2.10.20 版本存在由四个问题组成的漏洞链，该链可将任何可网络访问的 DataEase 变为远程代码执行： | CVE| 漏洞类...

CVE-2023-22524

Atlassian Companion RCE漏洞概念验证 CVE-2023-22524 概述 此仓库包含针对 macOS 版 Atlassian Companion 中最近发现的远程代码执行漏洞（标识为 CVE-2023-22524）的概念验证。此严重漏洞允许攻击者绕过应用的阻止列表和 macOS Gatekeeper，从而导致潜在的有害代码执行。 详情 该漏洞源于应用在处理某些文件类型及其与 macOS 安全功能交互时的疏忽。有关该漏洞的详细分析，包括发现过程和技术细节，请参阅我们在 Imperva 威胁研究博客 上的综合博文。 复现步骤 1. 需要 Atlassian...

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...

fastjson-1.2.60-rce

Fastjson = 1.2.60 反序列化漏洞 By Pass autoType Block List with 2 Gadgets JNDIConfiguration、OracleManagedConnectionFactory Gadgets 经过测试，命中的4个文件都是可以利用的。 不过其中HikariConfig类就是前文提到的类，在最新版本被加入黑名单，JNDIConnectionPool类在42版本前就被加入黑名单了。 另外的两个类JNDIConfiguration和 OracleManagedConnectionFactory都可以构造出攻击poc，且尚未被加入黑名单。...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - Chyrp Lite ≤ 2026.01（“Iriomote”）中的已认证 RCE 漏洞 链式攻击： uploadspath 黑名单绕过（CVE-2026-53768）+ adminupdateupload 缺少文件扩展名验证（CVE-2026-53767）→ 以 www-data 身份远程执行代码 概述 Chyrp Lite ≤ 2026.01 存在已认证远程代码执行链漏洞，任何拥有 changesettings 和 editupload 权限（默认为管理员）的用户均可利用。 |...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload 任务 → 无认证 → 3字符串过滤器绕过（ 概述 DJ-Classifieds（Joomla 扩展）存在未授权任意文件上传漏洞。imageupload 任务端点在无身份验证 的情况下处理文件上传，并依赖一个3字符串黑名单 （?php、eval、base64），该黑名单可通过 PHP 短开标签（?=）轻松绕过。结合 GIF 多语言（polyglot）文件，上传的文件能通过所有图像校验，同时包含功能完整的 PHP WebShell。 字段| 详情 ---|--- CVE|...

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-61851 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-61851

Chartbrew is an open-source web application that connects to databases and APIs to create charts. Prior to 5.2.2 , its runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js enforced read-only database access using a blocklist of only seven SQL keywords . An authenticated u...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-57141

PraisonAI (praisonai npm, a TypeScript multi-agent AI framework) is vulnerable to remote code execution via its codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts. The tool executes LLM-generated JavaScript using new Function() with a with(sandbox) pattern guarded by a regex blockl...

CVE-2026-37008

CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

PYSEC-2026-3836 GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

VulnCheck KEV: CVE-2026-60105

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...

CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

EUVD-2026-71715

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...