CVE-2024-34102

Cosmic Sting: Explotador de CVE-2024-34102 Cosmic Sting es una herramienta basada en Go diseñada para explotar CVE-2024-34102, una vulnerabilidad de ejecución remota de código. Detalle de CVE-2024-34102 Las versiones de Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores se ven...

CVE-2025-27136

CVE-2025-27136 利用 XML 外部实体 XXE 漏洞。 使用 XML 载荷抓取敏感文件（PoC） test.xml root@kitploit: 使用 curl 将 test.xml 从本地机器上传到存储桶。 root@kitploit: curl -X PUT http://127.0.0.1:PORT/TB1 -H "Content-Type: application/xml" -d @test.xml 触发漏洞并获取文件 root@kitploit: curl http://127.0.0.1:PORT/TB1?location...

CVE-2023-46604

CVE-2023-46604 该仓库包含针对影响 Apache ActiveMQ 的 CVE-2023-46604 漏洞的利用脚本和概念验证 PoC XML 文件。该漏洞由于 OpenWire 协议中的不安全反序列化实践，允许远程代码执行。 描述 CVE-2023-46604 是 Apache ActiveMQ 的 OpenWire 协议中存在的一个反序列化漏洞。攻击者可以利用此漏洞在运行 ActiveMQ 的服务器上执行任意代码。本仓库中的利用脚本自动化了向服务器发送精心构造的请求以触发该漏洞的过程。 仓库内容 exploit.py - 触发漏洞的主要 Python 利用脚本。...

CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2020-2555

EXP prueba...

CVE-2026-86137

A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the xmlFAParsePosCharGroup function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory...

libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness entropy for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result ...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

BIT-JENKINS-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

NewStart CGSL MAIN 7.02 : expat Vulnerability (NS-SA-2026-0101)

The remote NewStart CGSL host, running version MAIN 7.02, has expat packages installed that are affected by a vulnerability: - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. CVE-2026-4518...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

EUVD-2026-72910

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup

A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the xmlFAParsePosCharGroup function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory...

CVE-2026-71979

A flaw was found in INDI indiserver. An unauthenticated remote attacker can exploit a stack buffer overflow vulnerability by sending specially crafted XML with oversized, mismatched tags. This can lead to an unbounded write operation, causing the daemon to crash and disrupting all active client a...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84646

Jenkins (versions 2.579 and earlier, LTS 2.568.2 and earlier) is affected by a lack of type restriction in XML deserialization , allowing an attacker with Overall/Read permission to create user objects by submitting crafted XML. The root cause is that user objects can appear as nested field value...