CVE-2021-26084

использование: python poc.py http://host:port/...

CVE-2021-3019

CVE-2021-3019 Ajoutez l'adresse IP dans le fichier ip.txt, attention au format : http://127.0.0.1 Un par ligne Ouvrez Cheeetah, puis exécutez-le...

Copyparty <=1.18.6 - Cross-Site Scripting

Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting XSS via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser. id: CVE-2025-54589...

SECURITY-3314-3315

= Atténuation de SECURITY-3314/SECURITY-3315 Ce dépôt documente les atténuations empêchant l'exploitation de SECURITY-3314 et SECURITY-3315 sur les instances concernées. == Aperçu L'accès à la CLI doit être désactivé. Les deux étapes suivantes doivent être effectuées : Supprimer le point de...

CVE-2026-23744

CVE-2026-23744 – Proof of Concept Скрипт Python в этом PoC отправляет простой HTTP-запрос на целевой хост, на котором запущен MCPJam inspector версия замените на ваш порт прослушивания Затем откройте другой shell и запустите PoC: cd CVE-2026-23744 python3 exploit.py Ссылки RCE в MCPJam inspector...

CVE-2025-24893

CVE-2025-24893 Использование python CVE-2025-24893 http://target.com...

CVE-2024-1561

CVE-2024-1561 - Gradio 임의 파일 읽기 CVE-2024-1561 은 4.13.0 이전 Gradio 버전에 영향을 주는 임의 파일 읽기 취약점입니다. Gradio는 머신러닝 모델과 AI 애플리케이션용 웹 인터페이스를 빠르게 구축하는 데 사용되는 널리 알려진 Python 프레임워크입니다. 이 취약점은 /componentserver 엔드포인트가 내부 Component 클래스의 어떤 메서드를 호출할 수 있는지 제대로 제한하지 않기 때문에 발생합니다. 공격자는 이 동작을 악용하여 HTTP로 노출될 의도가 없는 메서드를...

CVE-2026-46453

camel-elasticsearch-rest-client Репродуктор инъекции через заголовки без префикса CVE-2026-46453 Этот проект демонстрирует инъекцию заголовков сообщений / обход авторизации в компоненте camel-elasticsearch-rest-client Apache Camel, отслеживаемую как CVE-2026-46453. Компонент читает несколько...

CVE-2019-3929

CVE-2019-3929 Injection de commande à distance Crestron/Barco/Extron/InFocus/TeqAV CVE-2019-3929 - Module Metasploit Per Tenable's description: "Un attaquant distant non authentifié peut exécuter des commandes du système d'exploitation en tant que root via des requêtes spécialement conçues vers l...

CVE-2021-37832

CVE-2021-37832 CVE 2021-37832 POC utilisation : python3 CVE-2021-37832.py http://test.com...

CVE-2023-23752

Installation git clone https://github.com/0xx01/CVE-2023-23752.git cd CVE-2023-23752 chmod +x exploit.sh Utilisation ./exploit.sh http://localhost...

EUVD-2026-86320

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect...

GHSA-3R68-HF9H-887V MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

CVE-2026-61568

@zereight/mcp-gitlab, a Model Context Protocol server for GitLab, is affected in versions prior to 2.1.30 . The Streamable HTTP MCP endpoint lacks an effective Host or Origin allowlist , allowing a malicious web page to exploit DNS rebinding to route browser requests to a victim's local MCP liste...

EUVD-2026-78660

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

EUVD-2026-78785

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

PT-2026-93183

Name of the Vulnerable Software and Affected Versions mySCADA myPRO Manager affected versions not specified Description The notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages via a connected GSM modem. Because the endpoint is accessible over the network and...

EUVD-2026-74270

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

EUVD-2026-71612

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...