CVE-2016-10033

CVE-2016-10033 该漏洞影响 PHPMailer 5.2.18，能够实现远程代码执行。 资源 https://vulners.com/cve/CVE-2016-10033 用法 由于是用 Golang 编写的，只要你的系统中安装了 golang，就可以自行构建漏洞利用程序： root@kitploit: cd CVE-2016-10033 go build 然后你可以使用以下语法运行该漏洞利用程序： 作者 我不是该 CVE 的作者，但我是这个漏洞利用程序的作者。 如果你使用或修改它，不允许去掉其中的版权信息。...

CVE-2021-21972

CVE-2021-21972 Descripción de la vulnerabilidad Vulnerabilidad de ejecución de código CVE-2021-21972 Un atacante malicioso con acceso al puerto 443 puede enviar solicitudes especialmente diseñadas a vCenter Server, lo que finalmente provoca la ejecución remota de código arbitrario. Detección de l...

SnakeYAML-CVE-2022-1471-POC

SnakeYAML-CVE-2022-1471-POC 用于 Veracode 博客的代码 为了演示代码执行： 1. 使用 Maven 构建项目 2. 执行 python3 -m http.server 8080 以运行 HTTP 服务器 3. 运行 exploit.java。你应该会在服务器上观察到一次 HTTP GET 请求 4. 为了演示 SnakeYAML 2.0 如何防止该攻击，请注释掉 pom.xml 中的 1.33 依赖 5. 取消注释 2.0 依赖，然后重新构建项目 6. 注释掉 exploit.java 并取消注释 Poc.java 7. 运行 Poc.java 并观察...

CVE-2026-82427

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82428

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-57125

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agentyaml, and the approve field can mark executecommand as YAML-approved before @requireapproval checks critical tools. This...

CVE-2026-25687

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

CVE-2026-57123

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable...

CVE-2020-5902

Resumen En las versiones 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 y 11.6.1-11.6.5.1 de BIG-IP, la Interfaz de Usuario de Gestión de Tráfico TMUI, también denominada utilidad de configuración, presenta una vulnerabilidad de Ejecución Remota de Código RCE en páginas no...

log4j2_vul_local_scanner

Log4j2 Vulnerability Local Scanner CVE-2021-45046 Log4j 漏洞本地检测脚本，扫描主机上所有java进程，检测是否引入了有漏洞的log4j-core jar包，是否可能遭到远程代码执行攻击（CVE-2021-45046）。上传扫描报告到指定的服务器。 Scan all java processes on your host to check whether it's affected by log4j2 remote code executionCVE-2021-45046, then upload the report to your...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084 Confluence 服务器远程代码执行漏洞。 Dork Fofa: app="ATLASSIAN-Confluence" 使用方法 显示帮助信息。 root@kitploit: python PoC.py 对单个网站进行漏洞验证。 root@kitploit: python PoC.py -u https://1.1.1.1 命令执行。 root@kitploit: python PoC.py -u https://1.1.1.1 -e 'cat /etc/passwd' 批量测试。 root@kitploit: python...

CVE-2026-90947

This vulnerability affects GIMP's Lighting Effects filter . When processing a specially crafted lighting preset file , the filter fails to properly validate the number of light sources, leading to an out-of-bounds write that corrupts memory. Exploitation requires a user to open a malicious preset...

CVE-2026-90947 Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

EUVD-2026-77593

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

CVE-2026-90947

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CVE-2026-21018

SveService: Desbordamiento de Búfer Samsung SMR May 2026 SVE-2026-0478CVE-2026-21018 Versiones afectadas: Android 14, 15, 16 Estado de divulgación: Divulgación privada Una escritura fuera de los límites en SveService anterior a SMR May-2026 Release 1 permite a atacantes locales privilegiados...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CVE-2026-57131 praisonai: Jobs API exposes agent-execution endpoints with no authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read job...