10 matches found
Wing-FTP-Server-7.4.4-RCE-Authenticated
Wing FTP Server 7.4.4 - Remote Code Execution Authenticated CVE-2025-5196 Wing FTP Server provides an administrative Lua scripting console accessible via its web interface. Authenticated administrators are able to execute arbitrary Lua code with insufficient sandboxing. Affected Version: Wing FTP...
CVE-2025-68613-Python-Exploit
CVE-2025-68613: n8n Workflow Expression RCE Proof of Concept PoC exploit for a critical Remote Code Execution vulnerability in the n8n workflow automation platform. Description The vulnerability exists in the n8n expression evaluation system. User-supplied expressions are not properly sandboxed,...
EUVD-2026-66223
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...
EUVD-2022-50305
Malicious code in bioql PyPI...
CVE-2022-47544
An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed...
Cross-Site Scripting (XSS)
Vega, vega-functions is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sandboxing, which allows unsupported JavaScript functions to be called from the Vega expression language...
Server-Side Template Injection
getgrav/grav is vulnerable to Server-Side Template Injection. The vulnerability is due to insufficient sandboxing and validation of user-defined Twig template functions and filters, allowing authenticated users to execute arbitrary code on the server...
CVE-2022-47544
An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed...
