CVE-2026-33310

CVE-2026-33310 CVE-2026-33310（参数默认值中通过 shell 展开导致的命令注入） 摘要 参数默认值中的 shell 语法似乎在目录解析过程中会被自动展开。 如果目录包含诸如 shell 的参数默认值，则在访问目录源时可能会执行该命令。 这意味着，如果用户加载了恶意的目录 YAML，嵌入的命令可能会在主机系统上执行。 此行为可能被归类为 CWE-78：操作系统命令注入 / 不安全的 Shell 展开。 详情 该问题似乎源于访问目录源时参数默认值的展开方式。 在目录加载和源访问期间： Intake 解析参数默认值 负责展开默认值的函数会处理 shell 语法...

CVE-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

CVE-2026-4060-PoC

CVE-2026-4060 — Geo Mashup ≤ 1.13.18 未认证SQL注入PoC -blue 未认证 攻击者可以通过Geo Mashup render-map 端点的 sort 参数向 ORDER BY 子句注入任意SQL，实现基于时间的盲注，提取敏感数据库信息。 目录 漏洞概述 测试环境 如何运行 测试结果 修复建议 检测方法 时间线 参考资料 漏洞概述 技术细节 render-map 端点接收的 sort 参数未经任何净化直接传入 $wpdb-getresults 调用： root@kitploit: // render-map.php 简化 $sort =...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory 插件 SQLi PoC 未认证的基于时间的盲 SQL 注入 Business Directory Plugin for WordPress ≤ 6.4.21 目录 漏洞概述 技术分析 实验环境要求 实验环境搭建 运行 PoC 预期输出 补丁分析 参考资料 免责声明 漏洞概述 字段| 详情 ---|--- CVE| CVE-2026-2576 插件| Business Directory Plugin – Easy Listing Directories for WordPress 厂商| strategy11team...

NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

Summary An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReferencename. When this node is serialized directly with: js serializer.serializeToStringref, requireWellFormed: true the invalid nodeName is emitted into the serialized XML...

EUVD-2026-69222

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization...

GHSA-6GMQ-8VP8-GCM6 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

Summary An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReferencename. When this node is serialized directly with: js serializer.serializeToStringref, requireWellFormed: true the invalid nodeName is emitted into the serialized XML...

CVE-2026-81571

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-19698

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

CVE-2026-10821

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

TelnetdBypass-

TelnetdBypass — Escáner CVE-2026-24061 Un escáner de seguridad basado en Python que detecta y explota CVE-2026-24061 , una vulnerabilidad crítica CVSS 9.8 de omisión de autenticación en versiones 1.9.3 a 2.7 del telnetd de GNU InetUtils. Cómo funciona El escáner inyecta un valor malicioso USER=-f...

EUVD-2026-61222

fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838 Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838

CVE-2026-84838 is a command injection vulnerability in rpmuncompress , a component of the RPM package management toolset. The root cause is that archive filenames containing shell metacharacters are not properly escaped before being passed to shell command strings via popen() , allowing a local a...

CVE-2026-84838 Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

EUVD-2026-70109

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...