CVE-2025-24893-PoC

CVE-2025-24893 - XWiki 远程代码执行 RCE 这是一个针对 CVE-2025-24893 的更新版概念验证 PoC 利用代码，该漏洞是 XWiki 中的一个关键未认证 RCE 漏洞。此版本在原版基础上进行了改进，允许执行任意 shell 命令并实现干净的反弹 shell 注入。 作者: HexHunter404 ⚠️ 警告 此代码仅供教育和授权的渗透测试使用 。 请勿将其用于您不拥有或未经明确许可测试的系统上。 ✨ 功能特点 支持通过 bash -c '' 执行命令 完全支持反弹 shell（通过 base64 绕过 Groovy 限制） 改进了命令输出的处理 保留...

cve-2023-1671

Cve-2023-1671 Cve-2023-1671（https://vulners.com/cve/CVE-2023-1671）是如何工作的？ /opt/ws/bin/ftsblistpack 是一个 Perl 脚本，它调用 /opt/ws/bin/sblistpack，这是另一个 Perl 脚本。 其中的 shell 命令参数用单引号括起来： root@kitploit: $rc += system"$sblistpack '$uri' '$user' '$filetype' '$filein' '$fileout'"; 这一点将来会很重要，它将成为导致漏洞的因素之一。...

Langflow-CVE-2025-3248-Multi-target

⚠️ Langflow RCE 漏洞利用扫描器 CVE-2025-3248 该基于 Python 的扫描器可通过 CVE-2025-3248 自动检测 Langflow 实例中的未认证远程代码执行（RCE）漏洞。它使用一个概念验证（PoC）载荷，滥用 /api/v1/validate/code 端点来执行任意 shell 命令。 🚨 CVE 详情 CVE ：CVE-2025-3248 影响 ：未认证远程代码执行 组件 ：Langflow API /api/v1/validate/code 利用方式 ：通过动态代码执行进行注入 风险 ：严重 🛠 功能特性 🔎 从文件批量扫描多个目标 ⚡️...

CVE-2023-46604

CVE-2023-46604 01. Apache ActiveMQ 和 OpenWire 1 Apache ActiveMQ 与 OpenWire 概述 ActiveMQ 是一个开源的消息传递和集成模式服务器，它包含支持 JMS 的代理（Broker），不仅可以在 Java 环境中使用，还能够实现使用多种语言的系统之间的通信。此外，通过集群功能、数据库以及文件系统，它维护了各系统之间的一致性和持久性。 OpenWire 是 Apache ActiveMQ 使用的一种二进制消息协议。它专为代理（ActiveMQ）与客户端之间的高效数据传输而设计。 CVE-2023-46604 是...

CVE-2024-4358

CVE-2024-4358 一个针对CVE-2024-4358的漏洞检测与批量利用工具 安装： root@kitploit: git clone https://github.com/RevoltSecurities/CVE-2024-4358 pip install -r requirements.txt python3 exploit.py --help 使用： root@kitploit: python3 exploit.py -h / / / / / / / / | |// // / / / / / / / / / / / / / / // // / / / / / / /...

cve-2025-49844

CVE-2025-49844 這是本人針對 CVE-2025-49844（又稱 RediShell）的個人概念驗證。 支援的目標建置版本： x86-64 Linux redis:8.2.1-alpine Docker 映像 x86-64 Linux redis:8.2.1-bookworm Docker 映像 它有點笨拙，可能不如 Wiz Research 的那麼好。不過，我很高興能在 Hexacon 2025 演講影片上傳前讓它運作起來，而且調查過程讓我獲益良多。 使用方法 執行單向 shell 指令： root@kitploit: $ uv run cve-2025-49844...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

PT-2026-85547

Name of the Vulnerable Software and Affected Versions goose versions prior to 1.38.0 Description The software executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. This occurs because the recipe security scan skips these two fields, allowing...

CVE-2026-53541

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-63046

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...

PT-2026-79344

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An argument injection issue exists in the Agent Installer's ModuleManager. The system executes arbitrary shell commands through the ExcuteLinux.exeCmd function because it lacks proper...

CVE-2026-18482 CVE-2026-18482

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...

ALPINE-CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961

Vim's s:NetrwMarkFile() function in runtime/pack/dist/opt/netrw/autoload/netrw.vim interpolates a directory-listing filename directly into a filter() expression string ('v:val != "'.dname.'"'). A crafted filename with a double quote breaks the literal, allowing arbitrary Vimscript and shell execu...

CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...