Groovy-scripting-engine-CVE-2015-1427

Ambiente de teste do bypass do sandbox Groovy do ElasticSearch && da vulnerabilidade de execução de código CVE-2015-1427 Versão do jre: openjdk:8-jre Versão do elasticsearch: v1.4.2 Princípio Referências: http://cb.drops.wiki/drops/papers-5107.html...

CVE-2022-40635

CVE-2022-40635: Bypass de Sandbox Groovy no CrafterCMS A vulnerabilidade de Controle Impróprio de Recursos de Código Gerenciados Dinamicamente no Crafter Studio do Crafter CMS permite que desenvolvedores autenticados executem comandos do sistema operacional por meio de um Bypass de Sandbox Groovy...

CVE-2025-6384

CVE-2025-6384: Bypass del Sandbox Groovy 2 in CrafterCMS La vulnerabilità di Controllo Improprio delle Risorse di Codice Gestite Dinamicamente in Crafter Studio di Crafter CMS consente a sviluppatori autenticati di eseguire comandi del sistema operativo tramite Bypass del Sandbox Groovy...

exploit-CVE-2015-1427

Elasticsearch 1.4.0 1.4.2 Esecuzione di codice remoto Elasticsearch è un motore di ricerca e analisi distribuito e RESTful in grado di risolvere un numero crescente di casi d'uso. Come cuore dello Elastic Stack, memorizza centralmente i tuoi dati così da poter scoprire l'atteso e rivelare...

CrafterCMS-CVE-2025-6384

CrafterCMS प्रमाणित RCE - Groovy सैंडबॉक्स बाईपास CVE-2025-6384 CrafterCMS में प्रमाणित रिमोट कोड एक्ज़ीक्यूशन भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट। भेद्यता सारांश डेवलपर विशेषाधिकारों वाला एक प्रमाणित उपयोगकर्ता रिमोट कोड एक्ज़ीक्यूशन RCE प्राप्त करने के लिए Crafter Studio में Groovy स्क्रिप्ट...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30665)

Apache Syncope is an open-source digital identity management system, primarily used for authentication, authorization, and account management. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from insufficient protection of the Groovy security sandbox, which leads ...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30660)

Apache Syncope is an open-source identity management platform, primarily used for user authentication, authorization, and account management in enterprise environments. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from a bypass of the Groovy security sandbox...

Remote Code Execution (RCE)

Crafter CMS is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper control of dynamically managed Groovy code, where authenticated developers can bypass the Groovy sandbox by injecting malicious Groovy elements, allowing execution of arbitrary OS commands...

CVE-2026-1770

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

GHSA-GJ28-GW7W-3PXC Crafter CMS has Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

Crafter CMS has Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

CVE-2026-1770 Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

CVE-2026-1770 Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

EUVD-2026-5112

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

PT-2026-5681

Name of the Vulnerable Software and Affected Versions Crafter CMS versions affected versions not specified Description An issue exists in Crafter Studio of Crafter CMS that allows authenticated developers to execute operating system commands. This is due to a bypass of the Groovy Sandbox...

Remote Code Execution (RCE)

CrafterCMS is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper control of dynamically-managed code resources due to a Groovy Sandbox bypass that allows authenticated developers to execute OS commands...

CVE-2025-6384 Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE Remote Code...

CVE-2025-6384 Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE Remote Code...

CVE-2025-6384

CrafterCMS Crafter Studio is affected by CVE-2025-6384 (versions 4.0.0–4.2.2). The issue is an Improper Control of Dynamically-Managed Code Resources that allows authenticated developers to bypass the Groovy sandbox, enabling remote code execution (RCE) by injecting malicious Groovy elements. The...

CrafterCMS 安全漏洞

CrafterCMS is a Java-based CMS from CrafterCMS, Inc. A security vulnerability exists in CrafterCMS versions 4.0.0 through 4.2.2 that stems from a Groovy sandbox bypass resulting in OS commands that can be executed by certified developers...