1265 matches found
Pheditor 2.0.1-2.0.3 - OS Command Injection
Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...
CVE-2023-38646
CVE-2023-38646 PoC 설명 이것은 오픈소스 비즈니스 인텔리전스 및 데이터 분석 도구인 Metabase를 익스플로잇하기 위한 개념 증명PoC 스크립트입니다. Metabase를 사용하면 사용자가 데이터를 시각화하고 상호 작용할 수 있어 데이터 분석을 위한 강력한 플랫폼을 제공합니다. CVE-2023-38646으로 지정된 이 취약점은 공격자가 인증 없이 서버에서 임의의 명령을 실행할 수 있게 했습니다. 이 결함의 영향은 심각했으며, 서버의 권한 수준에서 서버에 대한 무단 액세스를 허용했습니다. 개념 증명PoC 단계 이...
CVE-2025-50286
Grav Admin Direct Install RCE CVE-2025-50286 Grav Admin 플러그인의 Direct Install 기능에서 인증된 원격 코드 실행을 위한 Metasploit 모듈 및 랩 설정입니다. 개요 CVE: CVE-2025-50286 영향: 인증된 RCE 벡터: 관리자 패널 → Direct Install 결과: 웹 서버 권한으로 임의 명령 실행 참조 CVE NVD Exploit-DB Metasploit에서 모듈 로드 cp gravadmindirectinstallrcecve202550286.rb...
CVE-2026-39353 InvoicePlane: Remote Code Execution via Writable Templates Directory
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious...
CVE-2026-39353 InvoicePlane: Remote Code Execution via Writable Templates Directory
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious...
CVE-2026-57139
The praisonai npm package (PraisonAI TypeScript multi-agent framework) is affected by an unauthenticated HTTP JSON-RPC vulnerability in MCPServer.startHttp(). The server binds to all interfaces (observed as :: IPv6) and forwards every POST to handleRequest() without credential checks, even though...
CVE-2026-50894: Unrestricted Upload of File with Dangerous Type
easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...
CVE-2026-84201 appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch
appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...
CVE-2026-75842
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
CVE-2026-48030
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...
CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...
CVE-2026-8481
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...
CVE-2026-58195
Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...
PYSEC-2026-2700 Open WebUI's chat completion API allows tool restrictions to be bypassed
Summary Open WebUI v0.6.43 contains a vulnerability in its chat completion API, which allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access. Details In the chatcompletion API, the parameters toolids and toolservers are supplied by the user. These...
PT-2026-59345
Summary Open WebUI v0.6.43 contains a vulnerability in its chat completion API, which allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access. Details In the chat completion API, the parameters tool ids and tool servers are supplied by the user. These...
CVE-2026-41876
CVE-2026-41876 affects R-SOFT DMS. The vulnerability is an OS Command Injection in konwertujAction(), where the document converter executes shell commands using unsanitized file paths and format parameters, allowing an authenticated attacker to run arbitrary commands with the web server user’s pr...
CVE-2026-41876 OS Command Injection in R-SOFT DMS
R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user...