SSE4-CVE-2022-22965

Spring Boot CVE-2022-22965 基于 Spring Boot 2.6.5 的 CVE-2022-22965 Docker 概念验证（PoC） 快速开始 1. 运行 docker compose up --build 构建并启动易受攻击的应用。 2. 运行 curl -H "Accept: text/html;"...

CVE-2025-55182

CVE-2025-55182 - React2Shell 针对 CVE-2025-55182 的改良与增强型漏洞利用工具，该漏洞是一个在 React Server 19.0、19.1.0、19.1.1 和 19.2.0 版本中存在预认证远程代码执行漏洞。 该漏洞涉及以下组件： react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack 补丁 通过以下检查修复了使用 chunk 引用来检索原型属性的问题： @@ -78,7 +80,10 @@ export function preloadModul...

CVE-2021-44906

CVE-2021-44906 原出处：https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip 运行 npm run hack 然后你会看到任意函数的 done 属性被改为 true。 命令行 node index.js --.concat.constructor.prototype.done true 的解释： -- 是命令行参数中常用的连字符标记。 是 minimist...

CVE-2025-55182

Aprendiendo sobre React Server Components y el protocolo Flight REact Server Components es una funcionalidad introducida en React 19, que permite que los componentes se rendericen en el servidor en lugar de en el navegador del lado del cliente. El servidor puede manejar tareas de cómputo compleja...

ReactNext2Shell

es-define-property Object.defineProperty, but not IE 8's broken one. Example const assert = require'assert'; const $defineProperty = require'es-define-property'; if $defineProperty assert.equal$defineProperty, Object.defineProperty; else if Object.defineProperty assert.equal$defineProperty, false...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — RCE no autenticada en GeoServer Un estudio completo y reproducible de la vulnerabilidad CVE-2024-36401 , un fallo de ejecución remota de código no autenticado en GeoServer — el servidor de código abierto más utilizado para datos geoespaciales. El error es una inyección de eval : ...

drupalgeddon2-CVE-2018-7600

Drupal - Drupalgeddon2 CVE 2018-7600 $ python3 drupalgeddon.py -h + drupalgeddon2 CVE-2018-7600 exploit by Rafael Caria usage: drupalgeddon.py -h --url URL --command COMMAND --function FUNCTION --test --proxy PROXY ! This script exploits CVE-2018-7600 a Drupal property injection in the Forms API...

Project-CVE-2025-54068

Livewire2025CVE Escáner de CVE-2025-54068 para Livewire Escáner automatizado de vulnerabilidades para detectar CVE-2025-54068 en aplicaciones Laravel que utilizan Livewire v3.0.0-beta.1 hasta v3.6.3. Descripción general Esta herramienta analiza una lista de sitios web en busca de indicadores de l...

CVE-2026-100174

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-100174

The AIL Framework tag selector component (specifically var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of input sanitization for tag names; the application passes the displayField value directly to the jQuery .html() property in both the ...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

EUVD-2026-87087

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-98148

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

AZL-104772 CVE-2026-98148 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

CVE-2026-98148 drm/gud: validate GUD_ROTATION_0 is present in supported rotations

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

CVE-2026-98148 drm/gud: validate GUD_ROTATION_0 is present in supported rotations

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

POC-CVE-2026-65971

CVE-2026-65971 — SQL Injection in Livewire PowerGrid via sortDirection Proof-of-concept and full technical write-up for CVE-2026-65971 / GHSA-7fgc-3h6c-698r , an SQL injection in power-components/livewire-powergrid reachable through the public Livewire property sortDirection. | ---|--- CVE|...

CVE-2026-92608

Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...

EUVD-2026-86582

Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...