CVE-2026-45087

Dalfox (server mode) prior to v2.13.0 is vulnerable to unauthenticated remote code execution. When running dalfox server with default 0.0.0.0:6664 and no API key, POST /scan deserializes attacker-controlled options (FoundAction and FoundActionShell) into scan config, then shell commands are execu...

Dalfox Found-Action Deserialization RCE

When dalfox version use exploit/linux/http/dalfox/serverrcecve202645087 msf undefinedserverrcecve202645087 show actions ...actions... msf undefinedserverrcecve202645087 set ACTION msf undefinedserverrcecve202645087 show options ...show and set options... msf undefinedserverrcecve202645087 run Thi...