CVE-2025-53772

CVE-2025-53772 - Эксплойт удаленного выполнения кода Microsoft Web Deploy Python-эксплойт для CVE-2025-53772 — уязвимости удаленного выполнения кода в Microsoft Web Deploy msdeploy, вызванной небезопасной десериализацией данных HTTP-заголовка. 🎬 Видео POC Обзор уязвимости Property| Value ---|---...

CVE-2018-11788

요약 Apache Karaf는 현대적이고 다형적인polymorphic 애플리케이션 컨테이너입니다. OSGi로 구동되는 경량이면서도 강력하고 엔터프라이즈 환경에 적합한 컨테이너입니다. Apache Karaf는 '제품 프로젝트product project'로서 완전하고 턴키turnkey 방식의 런타임을 제공합니다. 이 런타임은 '다중 측면multi-facets'을 지니고 있어 OSGi 또는 비OSGi, 웹 애플리케이션, 서비스 기반 등 다양한 종류의 애플리케이션을 배포할 수 있습니다. Apache Karaf에 대한 최근 연구에서 저...

pgAdminOpendoor

pgAdminOpendoor CVE-2025-2945 Обзор Это моё исследование по CVE-2025-2945. Этот репозиторий содержит тестовый стенд с PostgreSQL и уязвимым pgAdmin, а также эксплойт. CVE Полезные ссылки: Детали NVD Анализ WIZ Metasploit Разбор В бэкенде pgAdmin, написанном на python, есть две конечные точки, в...

nimbostratus-target

Целевая инфраструктура Nimbostratus В этом репозитории находится целевая инфраструктура, которую вы можете использовать для тестирования nimbostratus. Этот код разворачивает инфраструктуру Amazon AWS, в которой присутствуют различные уязвимости и слабые настройки конфигурации, которые можно...

egg-scripts-CVE-2018-3786

egg-scripts Инструмент развертывания для проекта egg. Примечание: Windows поддерживается частично, см.22 Установка $ npm i egg-scripts --save Использование Добавьте eggctl в скрипты package.json: "scripts": "start": "eggctl start --daemon", "stop": "eggctl stop" Затем запускайте следующим образом...

cdt-samba-deploy

cdt-samba-deploy Ubuntu 시스템에 CVE-2017-7494일명 "SambaCry"를 배포하기 위한 CDT Ansible 플레이북...

EUVD-2026-44640

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source...

CVE-2026-62176

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

EUVD-2026-94521

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-62176

The PraisonAI multi-agent system is vulnerable to code injection in versions prior to 4.6.78 . The flaw exists in the deploy/api.py and deploy/docker.py modules, where the agents_file parameter is directly interpolated into an f-string without sanitization. This generated code is then written to ...

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Summary The deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...

GHSA-G6J7-PFFP-8WHG PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Summary The deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile value via CLI argument, configuration, or upstream API can...

PT-2026-107589

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description The deploy/api.py module generates Python server code by directly interpolating the agents file parameter into an f-string, which is subsequently written to a file and executed using...

CVE-2026-79960

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960 Gitea deploy key pushes acting as the repository owner

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...

CVE-2026-79960

The Gitea repository management platform contains a vulnerability where pushes authenticated with a deploy key are incorrectly recorded as being performed by the repository owner. This Incorrect Authorization (CWE-863) causes permission checks in the push hook pipeline to evaluate the owner's pri...