vBulletin_5.x-tab_panel-RCE

vBulletin5.x-tabpanel-RCE CVE-2020-17496 is a vulnerability in vBulletin’s ajax/render/widgetphp route by injecting malicious code via the widgetConfig parameter. Affected System vBulletin 5.5.4 5.6.2 vBulletin 5.x Widgettabbedcontainertabpanel RCE Vuln Test script Usage python...

CVE-2019-5418

CVE-2019-5418 - File Content Disclosure on Rails EDIT : this CVE can lead to a Remote Code Execution, more info: https://github.com/mpgn/Rails-doubletap-RCE There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to rend...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Resources https://vulners.com/cve/CVE-2016-2098 Usage To use this...

CVE-2016-2098-my-first-exploit

CVE-2016-2098-my-first-exploit This exploit is remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. It's written in python3, and remember to install the requests library. here is the command. pip3 install requests...

CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

EUVD-2026-109463

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying |URL wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal...

CVE-2026-116205

Versions of YesWiki before 4.7.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) vulnerability. The root cause lies in the render handler , which fails to properly sanitize the [[|URL]] wiki syntax . Remote attackers can exploit this by supplying the malicious syntax in th...

CVE-2016-2098

CVE-2016-2098 Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. Explanation: This issue comes from the usage of the render method on user-supplied data. The method render is usually used to render a page from a template, but render method also allows...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

Welcome to React Router! A modern, production-ready template for building full-stack React applications using React Router. Features 🚀 Server-side rendering ⚡️ Hot Module Replacement HMR 📦 Asset bundling and optimization 🔄 Data loading and mutations 🔒 TypeScript by default 🎉 TailwindCSS for stylin...

CVE-2018-7600

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2018-7600 - Day Started: 26/06/2024. Table of contents: 1. CVE summary 2. Prerequisites 3. CVE Analyse 4. Mitigation CVE summary An attacker could call a Drupal Form API Ajax Request containing the calluserfunc auto do function Drupal before 7.58,...

CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options, remote code execution may be triggered in downstream applications. Source...

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

CVE-2020-8163

CVE-2020-8163 CVE-2020-8163 - Remote code execution of user-provided local names in Rails Remote code execution of user-provided local names in Rails 5.0.1 There was a vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render cal...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. https://vulners.com/cve/CVE-2016-2098 Usage git clone...

CVE-2018-7600

CVE-2018-7600 - Drupal 7 Remote Code Execution A Rust implementation of the CVE-2018-7600 exploit targeting vulnerable Drupal 7 installations = 7.57. This CLI reproduces this following PoC flow: it poisons a cached renderable form via the user/password path, extracts a formbuildid, then triggers...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Class Input Validation Error Credits Tobias Kraze from makandra an...

CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC

CVE-2024-25600 — WordPress Bricks Builder RCE PoC Unauthenticated remote code execution vulnerability in WordPress Bricks Builder id uid=33www-data gid=33www-data groups=33www-data References CVE-2024-25600 Bricks Builder Security Advisory Wordfence writeup Credits Discovery: Snicco / Calvin Alka...

cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 Vulnerability Lab Educational lab demonstrating exploitation of CVE-2018-7600 Drupalgeddon2 using a vulnerable Drupal 7.56 environment deployed with Docker. This project simulates a real-world vulnerability assessment workflow, including: Vulnerable environment setup...

CVE-2019-19919

CVE-2019-19919 Handlebars Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' Vulnerability pip install requests packaging python handlebarsscanner.py pip install requests python handlebarsexploit.py Enter the target URL: Exploit Expected Output : Ente...