EUVD-2026-70108

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A command injection vulnerability was identified in rpm , specifically in the gettarspec function used by rpmbuild -t*. The root cause is an unescaped tarball path or filename that, when containing shell metacharacters, allows an attacker to inject arbitrary commands. This is particularly relevan...

CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the executi...

CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 远程代码执行 针对 Dolibarr ERP/CRM v17.0.0 的 PHP 代码注入利用程序，允许通过 Website/CMS 模块以 www-data 用户身份获得 反向 shell 。 ⚠️ 仅限教育用途和授权审计。 📑 目录 什么是 CVE-2023-30253？ 漏洞如何工作？ 影响 此利用程序做什么？ 要求 安装 用法 实际示例 利用程序逐步说明 缓解措施 参考...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-33017-Exploit

CVE-2026-33017 - Langflow RCE sin autenticación root@kitploit: / \ | | \ ^ / ||||| exec sin autenticación, sin sandbox, sin esperanza. Langflow chat.py - startflowbuild - buildgraphfromdata - Graph.frompayload - loading.py - eval.py createclass - validate.py prepareglobalscope - execcompiledcode ...

CVE-2025-24893

CVE-2025-24893 XWiki上でのリモートコード実行（RCE）エクスプロイト CVE-2025-24893 に対するPython3エクスプロイト。XWiki プラットフォームに影響する、認証不要のリモートコード実行（RCE）の重大な脆弱性です。...

CVE-2026-24061

Docker Telnet 自动登录实验环境 一个用于实验 Telnet 协议协商 的轻量级 Docker 实验环境，相关原理在 CVE-2026-24061 漏洞利用中有所说明，该漏洞利用通过 NEW-ENVIRON 选项实现自动用户名注入。 本项目创建了一个隔离的客户端-服务器环境，用于研究 Telnet 如何处理基于环境变量的认证绕过。 功能特性 使用 Docker Compose 构建的隔离双容器实验环境 自定义 Python Telnet 客户端 自动注入 USER 环境变量 基本的 Telnet 选项协商处理 基于 Docker 内部 DNS 的服务发现 最小化、可复现的配置...

EUVD-2026-62600

Orval: Import-time RCE via query-parameter default - zod module-level template literal...

EUVD-2026-62596

Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client...

CVE-2025-60787

CVE-2025-60787 CVE-2025-60787 Poc - RCE - MotionEye = 0.43.1b4 原始链接：https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter MotionEye 通过客户端验证绕过实现 RCE 摘要 在对运行在 Docker 中的 MotionEye 实例进行安全测试时，发现 Web UI 中的客户端验证可以被绕过。这允许提交任意输入，包括可能触发宿主容器执行命令的载荷。该问题如果被利用，存在远程代码执行（RCE）的风险。 受影响版本 ：包括...

CVE-2026-23744

CVE-2026-23744 — MCP Connect RCE via Unauthenticated Command Injection ⚠️ Disclaimer: This repository is for educational and security research purposes only. Using this exploit against systems without explicit authorization is illegal. The author is not responsible for any misuse of this code. 📌...

EUVD-2026-70052

Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in t...

CVE-2026-35196

CVE-2026-35196 · Chamilo LMS · OSコマンドインジェクション → RCE 研究者: K 開示タイプ: 責任ある開示 ステータス: 修正済み 影響を受ける製品: Chamilo LMS 2.0 v1.11.32 で確認...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...