vuln4japi

vuln4japi 一个存在漏洞的基于 Java 的 REST API，用于演示 CVE-2021-44228（log4shell）。 动机 Log4Shell 在 2021 年 12 月初席卷了整个互联网。Apache Log4j 日志库中的一个零日漏洞能够实现远程代码执行（RCE），导致全球各地的组织争相修复、打补丁和缓解其面向公众的 Java 应用程序。随着信息安全社区团结起来，为安全团队提供持续的分析和解决方案，Log4j 社区也在忙着开发补丁，以确保这一漏洞的终结。 我开发了这个简单的存在漏洞的 REST API，通过利用 Apache Tomcat...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – 自定义区块构建器（Custom Block Builder）– Lazy Blocks ≤ 4.2.0 中的认证远程代码执行漏洞 研究员 : ZeYrOXxx 插件 : 自定义区块构建器 – Lazy Blocks 受影响版本 : ≤ 4.2.0 严重性 : 高 CVSS : 8.8 漏洞类型 : 认证远程代码执行（RCE） 攻击向量 : REST API 所需权限 : editposts（贡献者及以上） 参考 Wordfence 公告:...

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPress 插件 未认证管理员访问 概念验证（PoC） ，演示 CVE-2026-23550 - Modular DS WordPress 插件 （版本 ≤2.5.1）中的严重未认证管理员账户接管漏洞。已在野外被积极利用。 攻击摘要 ：/api/modular-connector/login 中缺陷的 REST API 路由在 origin=mo 时绕过 WordPress 认证，授予未认证管理员会话 Cookie。 🚀 快速演示 - 如果您已配置好 WP 生产就绪 PoC...

CVE-2026-6227

CVE-2026-6227: Local File Inclusion in BackWPup Advisory Summary BackWPup versions up to and including 5.6.6 are affected by an authenticated Local File Inclusion LFI vulnerability via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint. The flaw was caused by non-recursive...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - Missing Authorization to Authenticated Student+ Privilege Escalation to Administrator 🔴 Vulnerability Overview CVE-2026-4484 — Authenticated Privilege Escalation Student → Administrator Field| Details ---|--- CVE ID| CVE-2026-4484 Severity| HIGH — CVSS v3.1...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...

Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

ImpactThis is an authorization bypass that escalates into unauthorized server-side job execution.1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

POC-CVE-2026-63030-CVE-2026-60137-

PoC: WP2Shell — CVE-2026-63030 & CVE-2026-60137 -red?style=for-the-badge 📌 Overview WP2Shell is a critical exploit chain in WordPress Core source code that allows a remote unauthenticated attacker to gain full control of the server Full Server Takeover / RCE. The exploit chain combines two securi...

CVE-2026-52680_exploit

CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Apache Kyuubi's REST API via the multipart batch-submission endpoint. POST /api/v1/batches multipart/form-data writes the resourceFile part to $KYUUBIHOME/work/upload// using the...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

CVE-2026-100514

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

CVE-2026-25632

CVE-2026-25632 — JSON Deserialization RCE in REST API Bugfix Challenge Inspired by a real 2026 vulnerability CVSS 10.0, actively exploited Based on: CVE-2026-25632 — Remote Code Execution via unsafe type-driven JSON deserialization discovered in the EPyT-Flow water-network simulation REST API and...

sxwp2shell

/ / / / / / | |/ / \ / / / / / / / / | / / / / / / / // / / / / / // | //// ///// /////|| sxwp2shell — Pre-auth RCE exploit for WordPress via REST API batch-route confusion CVE-2026-63030 + SQL injection CVE-2026-60137. Affected: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Install git clone...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...