CVE-2023-5044

CVE-2023-5044 Injection de code via l'annotation nginx.ingress.kubernetes.io/permanent-redirect Tout d'abord, vous devez déployer le Pod & Service : root@kitploit: kind: Pod apiVersion: v1 metadata: name: apple-app labels: app: apple spec: containers: - name: apple-app image: hashicorp/http-echo...

Blackash-CVE-2025-47812

🛡️ CVE-2025-47812 – Wing FTP Server의 치명적 RCE 🛡️ 🔎 개요: CVE-2025-47812는 Wing FTP Server 7.4.4 이전 버전에 영향을 미치는 치명적인 원격 코드 실행RCE 취약점입니다. 보안 연구원에 의해 발견되었으며, 실제 환경에서 적극적으로 악용 되고 있는 것으로 확인되었습니다. 🧱 근본 원인: 이 취약점은 Wing FTP Server의 인증 로직 , 특히 username 매개변수의 널 바이트\0 처리 방식에 존재합니다. 공격자는 username 필드를 통해 임의의 Lua 코드...

CVE-2025-47812-Research

CVE-2025-47812 — Wing FTP Server RCE исследование Контекст Стажировка по наблюдению в кибербезопасности, проведенная в клубе Akasec 1337 Khouribga — июль/август 2025 г. Изученная уязвимость CVE : CVE-2025-47812 Оценка CVSS : 10.0 Критическая Затронутое ПО : Wing FTP Server 7.4.4 Тип : Удаленное...

CVE-2025-47812

CVE-2025-47812 – Эксплойт RCE для Wing FTP Server Название эксплойта: Wing FTP Server 7.4.4 Удаленное выполнение кода через внедрение Lua CVE: CVE-2025-47812 Протестировано на: Wing FTP Server v7.3.x Windows/Linux Воздействие: Удаленное выполнение кода RCE с правами SYSTEM/root Серьезность:...

CVE-2026-44403-WingFTP-v8.1.2-POC-Exploit

Wing FTP Server v8.1.2 contient une vulnérabilité d'exécution de code à distance RCE dans le mécanisme de sérialisation des sessions. Un administrateur authentifié peut injecter du code Lua arbitraire via le champ mydirectory basefolder de l'administrateur de domaine, qui est exécuté côté serveur...

CVE-2025-47812

CVE-2025-47812 — Wing FTP Server RCE sans authentification réécriture Exploit Python pour la RCE par injection Lua sans authentification dans Wing FTP Server ≤ 7.4.3. Conçu pour la livraison de shell — une commande de check à un callback netcat fonctionnel. Écrit il y a quelque temps pour le lab...

CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE via injection Lua Auteur : 0xgh057r3c0n 🧠 Description Cet exploit exploite une vulnérabilité d'injection Lua dans le gestionnaire de connexion de Wing FTP Server loginok.html pour exécuter des commandes arbitraires du système d'exploitation ou obtenir un shell...

CVE-2025-47812-poC

CVE-2025-47812-poC Exploit simple pour RCE Wing FTP Server CVE-2025-47812 pour exécuter des commandes et obtenir un reverse shell. Pour usage éducatif uniquement. Détails de la vulnérabilité Cette vulnérabilité de sécurité a été divulguée publiquement et détaillée par RCESecurity...

CVE-2026-44403

Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...

Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server

CVE-2025-47812 — Wing FTP Server Unauth RCE rewrite Python...

CVE-2026-44403 Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization

Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session...

EUVD-2026-25280

Contour has Lua code injection via Cookie Path Rewrite Policy...

CVE-2026-41246

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

CVE-2026-41246 Contour: Lua code injection via Cookie Path Rewrite Policy

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resources can craft a malicious value in...

Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server

\ CVE-2025-47812 — Wing FTP Server RCE Research \ Contexte...

EUVD-2025-30791

Malicious code in bioql PyPI...

EUVD-2022-29582

Malicious code in bioql PyPI...

CVE-2025-57439

Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full system compromise, including reverse...

PT-2025-38760

Name of the Vulnerable Software and Affected Versions Creacast Creabox Manager version 4.4.4 Description A critical Remote Code Execution issue exists in Creacast Creabox Manager version 4.4.4. An authenticated attacker can inject arbitrary Lua code into the configuration through the edit.php...

CVE-2025-57439

Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full system compromise, including reverse...