CVE-2026-101882

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the...

CVE-2025-7775-vulnerable-lab

CVE-2025-7775 취약한 실습 환경 이 저장소는 CVE-2025-7775에 대한 nuclei 템플릿을 테스트하기 위한 취약한 환경을 제공합니다. 실행 docker build -t vuln-app . docker run -d --name vuln-test -p 5000:5000 vuln-app 취약점 테스트 1. 원격 명령 실행 RCE curl -X POST http://localhost:5000/api/v1/configuration \ -H "Content-Type: application/json" \ -d...

EUVD-2026-89755

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

CVE-2026-87902

CVE-2026-87902 | ---|--- Advisory| GHSA-7hp8-65ch-5whp Product| WordPress = 7.1.1, fixed in 7.1.2; both versions tested Sink| wp-includes/template.php, getpagetemplate Cause| the candidate built from pagename is not passed through validatefile Actor| anonymous, no account, no cookie, no CSRF toke...

ROS-20260930-73-0085

The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1782977299)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782977299 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782204526)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782204526 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use t...

CVE-2019-20197

Nagios XI リモートコマンド実行の脆弱性CVE-2019-20197 POC： POST /nagiosxi/includes/components/scheduledreporting/schedulereport.php HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:49.0 Gecko/20100101 Firefox/49.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/ ;q=0.8...

cve-2020-11651-exp-plus

bash を使用して --exec パラメータを実行するようにしました。元のスクリプトは /bin/sh だったため、bash リバースシェルなどの一部のコマンドと互換性がありません。 2. 元のコードはローカルの salt-master のバージョンを取得してリモートホストが影響を受けるかどうかを判断していましたが、これは明らかな論理エラーです。関連するコードを直接削除しました。 3. バッチスキャン機能を追加しました。python saltstack.py -b targetsfile.txt --threads 16 、targetfile.txt の内容は以下の通りです。...

CVE-2026-5426

CVE-2026-5426 ⚡ 簡単な使い方 このプロジェクトは、以下のような安全で許可された環境でのみ使用してください。 ローカル仮想マシン Dockerコンテナ 隔離されたラボ環境 許可されたペネトレーションテスト環境 セットアップ例: git clone cd 使用例: Test a single target for vulnerability python cve-2026-5426.py -t https://example.com Scan multiple targets from a file python cve-2026-5426.py -t targets.txt...

Axis1.4-CVE-2019-0227

Axis1.4 CVE-2019-0227 원격 명령 실행 취약점 도구 📖 취약점 설명 Apache Axis1.4에는 원격 명령 실행 취약점CVE-2019-0227이 존재합니다. enableRemoteAdmin 속성이 true로 설정된 경우, 공격자는 AdminService 인터페이스를 통해 악성 서비스를 배포하여 대상 서버에서 임의의 시스템 명령을 실행할 수 있습니다. 영향받는 버전 : Apache Axis ≤ 1.4 발생 조건 : enableRemoteAdmin이 true로 설정됨 🎯 두 가지 이용 방법 방법| 스크립트| 원리...

vsftpd-cve-2011-2523-lab

VSFTPD 2.3.4 백도어 익스플로잇 CVE-2011-2523 의도적으로 취약하게 설계된 Metasploitable2 가상 머신에서 VSFTPD 2.3.4 백도어CVE-2011-2523를 식별하고 Metasploit Framework를 사용하여 익스플로잇하는 실습형 침투 테스트 연구입니다. 면책 조항 이 프로젝트는 사이버 보안 교육을 위해 설계된 의도적으로 취약한 가상 머신인 Metasploitable2 를 사용하여 완전히 통제된 실험실 환경에서 수행되었습니다. 이 실습 중에 무단 시스템이나 네트워크를 대상으로 하지...

VIVOTEK Camera Firmware

ADVISORY SUMMARY Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

CVE-2023-30990

CVE-2023-30990 エクスプロイト 詳細は当社のブログ記事を参照してください: https://blog.silentsignal.eu/2025/09/04/Exploit-development-for-IBM-i/ Pythonスクリプトには ebcdic モジュールが必要です: pip install ebcdic DRDA S38CMD メソッド python3 ddm.py "" DRDA SQL メソッド python3 ddm-bypass-test.py "" S38CMD メソッドを使用したシンプルなバインドシェル ./exploit.sh...

OTRS-4.0.1-6.0.1-Remote-Command-Execution

OTRS-4.0.1-6.0.1 リモートコマンド実行 このエクスプロイトは https://www.exploit-db.com/exploits/43853 に基づいて開発されています。 OTRS パネルに対する認証を実行し、リバースシェルを提供します。 使用方法: python3 CVE-2017-16921.py CVE-2017-16921: OTRS 6.0.x（6.0.1 まで）、OTRS 5.0.x（5.0.24 まで）、および OTRS 4.0.x（4.0.26 まで）において、エージェントとして OTRS にログインしている攻撃者が、（PGP...

CNVD-C-2019-48814

CNVD-C-2019-48814 WebLogic wls9-async 逆シリアル化リモートコード実行の脆弱性 weblogic 用のエコー PoC Patch update: https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html 脆弱性の再現： http://10.10.20.166:7001/async/AsyncResponseService curl -i http://10.10.20.166:7001/async/favicon.ico...

mcpjam-cve-2026-23744-validator

MCPJam Inspector 認可済みセキュリティバリデータ 脆弱なMCPJam Inspectorデプロイメントに影響するCVE-2026-23744 のための制限された概念実証バリデータです。 このプロジェクトは、以前に開示されたCVE-2026-23744のための独立した非破壊的な検証ツールです。元の脆弱性開示やエクスプロイトではありません。 このリポジトリは、自身が所有する、または明示的な書面による評価権限を持つシステムを検証するセキュリティ専門家を対象としています。 重要な注意事項 このバリデータは、対象のMCPJam...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

CVE-2026-85134

The eBA Plus Document and Workflow Management System by Bimser Solution Software Trade Inc. is vulnerable to an unrestricted upload of files with dangerous types . This flaw allows an attacker to upload a web shell to the web server, potentially leading to Remote Command Execution . The issue imp...

CVE-2026-85134 Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus

Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11...