270346 matches found
NPM: Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
NPM: Claude Code Templates: Unauthenticated OS command injection RCE in Claude Code Studio server --studio vulnerability discovered by ? in WordPress Npm claude-code-templates versions = 1.29.2...
OpenVAS-Vulnerability-Analysis-Incident-Response-Report
OpenVAS-Vulnerability-Analysis-Incident-Response-Report Real-World Simulation: FTP Service Exploitation ProFTPD CVE-2015-3306 Real-World Simulation: FTP Service Exploitation ProFTPD CVE-2015-3306 📌 Overview This project demonstrates a full-cycle vulnerability assessment and incident response...
CVE-2022-26134
CVE-2022-26134 Confluence 未认证对象图导航语言（OGNL）注入 Confluence 是 Atlassian 开发的一款基于 Web 的工作区协作产品。它可以本地部署，也可以作为 Atlassian Cloud 的一部分使用。它由 3 个关键部分组成：页面、空间和页面树。 页面：你的内容存在于页面中——这些是你可以在 Confluence 站点上创建的动态文档。你几乎可以为任何内容创建页面，从项目计划到会议记录、故障排查指南、策略等。 空间：页面存储在空间中——你可以在这些工作区内协作工作并保持所有内容井然有序。...
CVE-2025-55182-Exploit-PoC-Scanner
CVE-2025-55182 - React Server Components RCE Exploit v2.0 A comprehensive security research tool for testing CVE-2025-55182 and CVE-2025-66478 vulnerabilities in React Server Components RSC and Next.js Server Actions. Vulnerability Overview...
Apache-Solr-RCE-via-Velocity-template
Apache-Solr-RCE-via-Velocity-template 参考链接 漏洞产生原因： 1. 当攻击者可以直接访问Solr控制台时，可以通过发送类似/节点名/config的POST请求对该节点的配置文件做更改。 2. Apache...
RP_Import_RCE
Real Player 'external::Import' 任意文件下载、目录遍历漏洞导致远程代码执行 视频演示：https://youtu.be/CONlijEgDLc Real Player 使用 Microsoft Internet Explorer 的功能，并通过一种应用程序特定的特殊方式暴露属性和方法： 'external' 对象暴露了多个自定义方法和属性。 'Import' 方法在处理 'Copy to My Music'...
RP_DCP_Code_Exec
Real Player 'DCP://' URI 远程任意代码执行漏洞 视频演示：https://youtu.be/AMODp3iTnqY 'DCP://' URI 方案是 Real Player 使用的一种内部协议，用于获取要在播放器浏览器选项卡中显示的 URL。 它代表"数据缓存协议"（Data Cache Protocol）。它将从 '%appdata%\real\realplayer' 目录获取文件。 这些文件是简单的 '.ini' 文件，包含以下代码： ---sampledcp.ini--- urls onlineurl=http://example.com/...
RealPlayer_G2_RCE
Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...
EUVD-2026-70709
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-85046
A type confusion in the V8 JavaScript engine in Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page. The vulnerability was reported by Salvatore Gulizia (Serotav) on 2026-08-04 and is ra...
cve-2024-56348
JetBrains TeamCity Authentication Bypass + RCE CVE-2024-56348 PoC 📜 Description CVE-2024-56348 is a critical authentication bypass vulnerability in JetBrains TeamCity on-premises affecting all versions prior to 2024.12. The REST API improperly handles requests to paths containing ;.jsp, allowing ...
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
CVE-2026-58400
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...
zencart_auth_rce_poc
zencartauthrcepoc CVE-2021-3291 1- 以管理员身份登录 2- 打开任意模块的编辑页面 3- 检查任意值为 true 的单选框元素 4- 将 true 改为 true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- 点击更新 6- 要触发命令，再次进入编辑页面 CVE-2021-3291 https://vulners.com/cve/CVE-2021-3291 POC 漏洞利用 刷新页面 放大 Metasploit GIF...
CSRF-to-RCE-on-Backdrop-CMS
Backdrop CMS 1.20 上的 CSRF 到 RCE 本 PoC 演示了如何利用 Backdrop CMS 1.20 版中的 CSRF 漏洞，并将其升级为 RCE（远程代码执行）。 CVE 编号 CVE-2021-45268 描述 Backdrop CMS 1.20 版本允许通过上传到站点的 ZIP 文件添加插件。由于它没有 CSRF 防护，攻击者可以创建一个包含允许执行命令的文件的插件，将其托管，并利用伪造页面，使站点管理员仅通过点击恶意链接即可上传该插件。 攻击场景 我们使用 GitHub 项目页面上提供的默认插件，在其中插入一个名为 shell.php...
CVE-2022-22963
CVE-2022-22963 Spring Cloud Function SpEL 表达式注入远程代码执行漏洞检测与利用工具。 漏洞概述 CVE-2022-22963 是 Spring Cloud Function 路由功能中的一个高危 RCE 漏洞（CVSS 9.8）。当应用启用 /functionRouter 端点时，spring.cloud.function.routing-expression 请求头的值会被直接作为 SpEL（Spring Expression Language）表达式执行，攻击者无需认证即可在目标服务器上执行任意系统命令。 受影响版本： 分支| 受影响版本|...