Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

CVE-2026-85475 Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component

A flaw was found in the Ansible Automation Platform automation controller. The external logging rsyslog configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript conf...

CVE-2023-29007

CVE-2023-29007 PoC repository for CVE-2023-29007 More information available at: https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007 https://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/...

CVE-2021-39172-RCE

CVE-2021-39172 Cachet 2.4: Ejecución de código mediante inyección de configuración de Laravel publicación del blog sobre la vulnerabilidad https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/ puedes usar esto para CTF o solo para aprender diviértete y que Dios l...

Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx...

Linux Distros Unpatched Vulnerability : CVE-2026-94572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is...

Linux Distros Unpatched Vulnerability : CVE-2026-94571

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RF...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2023-33246

CVE-2023-33246 - RocketMQ 远程代码执行 CVE-2023-33246 - Apache RocketMQ 配置远程代码执行漏洞 概述 RocketMQ 是一个分布式消息流平台。 RocketMQ 5.1.0 及以下版本存在任意代码注入漏洞。RocketMQ 的 Broker 组件暴露在外部网络，且缺乏权限验证。攻击者可以利用此漏洞，通过更新配置功能以运行 RocketMQ 的系统用户身份执行命令。此外，攻击者还可以通过伪造 RocketMQ 协议内容达到同样效果。 检测 RocketMQ 版本以识别漏洞 root@kitploit: usage: check.p...

IngressNightmare-RCE-POC

⚠️ Critical RCE in Ingress-NGINX via Configuration Injection CVE-2025-1974 and more 此仓库包含针对 CVE-2025-1974 的概念验证（PoC）利用程序，这是 Kubernetes 的 Ingress-NGINX 控制器中的一个严重（CVSS 9.8 ）漏洞。该漏洞允许未经身份验证的攻击者通过使用 Validating Admission Controller 时不安全的配置注入实现远程代码执行。这是 2025 年 3 月 26 日披露并修复的五项漏洞中最严重的一个。 📌 影响： •...

CVE-2023-29007_win-version

CVE-2023-29007Windows版本 原始PoC https://github.com/ethiack/CVE-2023-29007 针对 CVE-2023-29007 的PoC仓库 更多信息请访问： https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007 https://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/...

CVE-2026-3288-lab

CVE-2026-3288 Laboratorio Vulnerable Docker Inyección de Configuración en NGINX Ingress Controller ⚠️ ADVERTENCIA : Este laboratorio contiene configuraciones intencionalmente vulnerables para SOLO ENTRENAMIENTO DE SEGURIDAD AUTORIZADO Resumen de la Vulnerabilidad CVE-2026-3288 CVSS 8.8 ALTO -...

cve-2024-4577

Script de prueba para CVE-2024-4577 Este script de Python es una herramienta simple PoC Prueba de Concepto para diagnosticar la vulnerabilidad más reciente de PHP CVE-2024-4577. ⚠️ Esta herramienta se proporciona con fines de diagnóstico de seguridad y debe usarse solo en sistemas propios o en...

CVE-2026-90937 froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files duri...

CVE-2026-90937 froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files duri...

Astra Linux – Vulnerability in python-pip

When installing a package from a Mercurial VCS URL e.g., “pip install hg+…” using pip before version 23.3, the specified Mercurial revision could be used to inject arbitrary configuration options into the “hg clone” call e.g., “--config”. Controlling the Mercurial configuration allows modifying t...

CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

EUVD-2023-60687

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...