RedSun-

RedSun Red Sun 취약점 저장소 평소 같으면 PoC 코드만 던져두고 사람들이 알아서 파악하게 했을 겁니다. 하지만 이번 건은 그럴 수가 없네요. 너무 웃기거든요. Windows Defender가 악성 파일에 클라우드 태그가 있다는 것을 알게 되면, 어처구니없고도 우스운 이유로, 보호를 담당해야 할 안티바이러스가 발견한 파일을 다시 원래 위치에 덮어쓰는 것이 좋은 생각이라고 판단합니다. PoC는 이 동작을 악용하여 시스템 파일을 덮어쓰고 관리자 권한을 획득합니다. 안티멀웨어 제품은 악성 파일을 제거해야 하는 것이지, 파...

EUVD-2026-91464

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Отравление образов Docker Registry V2 Schema 1 Программный код Python Flask + Shell dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers': 'sha256:abc', 'sha256:def',...

CVE-2026-44024_exploit

CVE-2026-44024 — Fluentd outfile $tag Path-Traversal Arbitrary File Write Неаутентифицированная произвольная запись файла в плагине outfile Fluentd через плейсхолдер $tag. outfile позволяет операторам задавать шаблон пути вывода с плейсхолдером $tag например, path /var/log/fluent/$tag...

RabbitMQ 4.0.x < 4.0.22 / 4.1.x < 4.1.14 / 4.2.x < 4.2.7 / 4.3.x < 4.3.1 Atom Exhaustion via Global Parameter Name

The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.22, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.7, or 4.3.x prior to 4.3.1. It is, therefore, affected by a denial of service vulnerability: - resourceexists/2, and the PUT and DELETE handlers, call...

CVE-2020-17530

CVE-2020-17530 POC rapide pour CVE-2020-17530. Dans les versions Apache Struts 2.0.0 - 2.5.25, une évaluation forcée du langage de navigation de graphes d'objets OGNL sur les entrées utilisateur brutes dans les attributs de balise peut conduire à une exécution de code à distance RCE. $ python...

CVE-2023-6000

CVE-2023-6000 PoC Как работает этот метод обнаружения? Этот шаблон проверяет следующий путь: /wp-content/plugins/popup-builder/readme.txt Основываясь на указанном Stable Tag, если версия ниже 4.2.3, то она считается уязвимой. Как запустить этот скрипт? 1. Скачайте Nuclei отсюда 2. Скопируйте шабл...

CVE-2021-34600

Proof of Concept для CVE-2021-34600 Подробное объяснение того, как работает этот PoC, можно найти в нашем посте в блоге. Со стороны пользователя мы добавили только две новые команды: hf 14a getchallenge и hf 14a opendoor . Чтобы они заработали, нам пришлось смешать некоторый код из форка iceman с...

CVE-2023-48104

CVE-2023-48104 HTML-инъекция в веб-клиенте Alinto/SOGo Производитель продукта Alinto Тип уязвимости HTML-инъекция Затронутые версии SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Обнаружил Spiridonov Ivan/E1tex PoC Только для демонстрационных целей...

svg-cheatsheet

Шпаргалка по SSRF в SVG Хосты, обрабатывающие SVG, потенциально могут быть уязвимы к SSRF, LFI, XSS и RCE из-за богатого набора функций SVG. Все эти методы указывают URI, который может быть абсолютным или относительным. Протоколы file и HTTP важно протестировать, но в зависимости от реализации...

CVE-2025-63915-There-is-a-Reflected-xss-vulnerability-exists-in-DoraCMS

CVE-2025-63915 Cible:https://www.html-js.cn Github:https://github.com/doramart/DoraCMS Version:V2.1.8 Nom de la vulnérabilité : Vulnérabilité de Cross-Site Scripting Réfléchi XSS dans DoraCMS V2.1.8 CWE-79 Type de vulnérabilité : Cross-Site Scripting Réfléchi XSS Réfléchi Date de découverte :...

CVE-2022-33980-POC

CVE-2022-33980 $script:js:java.lang.Runtime.getRuntime.exec"calc"...

CVE-2023-27372-PoC

Ceci est une preuve de concept de la vulnérabilité RCE SPIP CVE-2023-27372. C'est une faille de désérialisation qui exploite l'utilisation dangereuse de la balise ENV lors de la fonctionnalité de réinitialisation de mot de passe spip.php?page=spippass dans /ecrire/balise/formulaire.php Plus...

CVE-2021-21042

CVE-2021-21042 Inspiré de https://www.zerodayinitiative.com/blog/2021/2/17/zdi-21-171-getting-information-disclosure-in-adobe-reader-through-the-id-tag...

CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

BIT-RABBITMQ-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

BIT-RABBITMQ-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's isauthorized/2 delegates to rabbitmgmtutil:isauthorizedmonitor/2, which accepts the monitoring tag. But allowedmethods includes DELETE, and deleteresource/2...

BIT-RABBITMQ-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, acceptcontent/2 at line 56 calls rabbitstreammanager:createsuperstream/... directly after isauthorized which only checks the management tag + vhost access via isauthorizedvhost. The stream-protocol...

BIT-RABBITMQ-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

BIT-RABBITMQ-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...