CVE-2025-24893-Reverse-Shell

CVE-2025-24893 - XWiki リモートコード実行エクスプロイト CVE-2025-24893 の PoC – XWiki マクロリモートコード実行 Artemir のオリジナル PoC に触発されました 説明 これは、脆弱なバージョンの XWiki におけるリモートコード実行 RCE 脆弱性である CVE-2025-24893 の Proof-of-Concept PoC エクスプロイトです。 この欠陥は、SolrSearch エンドポイント内でのユーザー入力の不適切なサニタイズにあり、RSS フィードクエリを介してサンドボックス化されていない...

xwiki-cve-2025-24893

XWiki SolrSearch 未认证 RCE CVE-2025-24893 贡献者 白帽学校 4期 25班 林斗妍@endusdksla 摘要 XWiki 在服务器端解析并渲染 wiki 语法和宏。问题在于 Main.SolrSearch 页面不仅对访客开放，而且还将用户输入的 text 参数在没有充分验证的情况下作为 XWiki 语法进行评估。 攻击者可以在 text 中插入 groovy 宏，从而在服务器上执行任意 Groovy 代码，并通过 "command".execute 调用操作系统命令。此漏洞无需额外登录或令牌，仅通过单个 GET 请求即可利用。 环境配置 本目录使用官...

CVE-2020-10131

CVE-2020-10131 - CVE-2020-10131 - SearchBlox 製品 V-9.2.1 以前は CSV マクロインジェクションに対して脆弱です。 製品説明: SearchBlox は、複雑な組織向けのエンタープライズ検索を簡素化します。SearchBlox の直感的でインテリジェントなツールは、すぐに使えるセットアップ、安全な暗号化、低い総所有コストを提供します。AI を活用したソリューションは、検索ジャーニーの各ステップを最適化し、エンゲージメントを劇的に向上させます。SearchBlox は、金融サービス、ヘルスケア、政府のリーダーにとって簡単な選択です。 説...

vba2clr

TLDR: VBA から AccessVBOM（Visual Basic プロジェクトへのプログラムによるアクセスが信頼されていない）を回避した後、AppDomain.ExecuteAssembly またはその他の便利なメソッドを使用して、CLR（.NET）アセンブリをローカルおよびリモートで VBA に読み込むさまざまな方法を試しているだけです。 vba2clr..vba: AccessVBOM レジストリキーを 1 に設定します。 Word.Application COMオブジェクトをインスタンス化します。（Excel.Application、MS PowerPoint、Access...

Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-3125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3125 advisory. A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

OESA-2026-3928 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

OESA-2026-3861 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

OESA-2026-3863 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

OESA-2026-3862 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

OESA-2026-3860 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

BIT-GRAFANA-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

SUSE CVE-2026-19475

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2026-19475

An authenticated user with permission to query a SQL datasource Microsoft SQL Server, PostgreSQL, or MySQL could bypass the fix for CVE-2026-33375 by injecting the $timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating the injected macro...

Linux Distros Unpatched Vulnerability : CVE-2026-19475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause,...

CVE-2026-19475

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2026-19475

Grafana is vulnerable to a denial of service via a bypass of the fix for CVE-2026-33375 . An authenticated user with permission to query a SQL data source can inject the timeGroup macro through a WHERE clause , which Grafana's regex-based macro parsing does not reject. Evaluating the injected mac...

EUVD-2026-70104

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

SUSE CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...