Wing-FTP-Server-7.4.4-RCE-Authenticated

Wing FTP Server 7.4.4 - 远程代码执行（需认证）（CVE-2025-5196） Wing FTP Server 提供了一个可通过其 Web 界面访问的管理 Lua 脚本控制台。经过身份验证的管理员能够执行任意 Lua 代码，但其沙箱机制不足。 受影响版本：Wing FTP Server 7.4.4 Windows | 需要身份验证：是 下载与发布说明 截至2025年5月24日，供应商提供的最新版本应用程序可通过以下链接获取：https://www.wftpserver.com/download.htm...

CVE-2025-68613-Python-Exploit

CVE-2025-68613: n8n Workflow Expression RCE Proof of Concept PoC exploit for a critical Remote Code Execution vulnerability in the n8n workflow automation platform. Description The vulnerability exists in the n8n expression evaluation system. User-supplied expressions are not properly sandboxed,...

EUVD-2026-66223

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

EUVD-2022-50305

Malicious code in bioql PyPI...

CVE-2022-47544

An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed...

Cross-Site Scripting (XSS)

Vega, vega-functions is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sandboxing, which allows unsupported JavaScript functions to be called from the Vega expression language...

Server-Side Template Injection

getgrav/grav is vulnerable to Server-Side Template Injection. The vulnerability is due to insufficient sandboxing and validation of user-defined Twig template functions and filters, allowing authenticated users to execute arbitrary code on the server...

CVE-2022-47544

An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed...

CVE-2021-37549

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient...