CVE-2022-22909

CVE-2022-22909 설명 Hotel Druid v3.0.3 애플리케이션에서 코드 삽입 취약점이 발견되었습니다. 공격자는 이를 악용하여 서버에서 원격 코드를 실행할 수 있습니다. 성공적으로 악용하려면 공격자가 새 방을 추가할 수 있는 권한이 있어야 합니다. 취약점 설명 이 취약점은 방 이름이 /dati/selectappartamenti.php 파일 안에 큰따옴표 를 사용하여 저장되기 때문에 발생합니다. Room1 Room2 Room3 "; ? 페이로드 성공적인 악용을 위해 다음 페이로드를 방 이름으로 사용하여 새 방을...

CVE-2022-42889-POC

CVE-2022-42889-POC Apache commons-text 취약점 CVE-2022-42889에 대한 개념 증명PoC입니다. 문제점 : Apache Commons Text는 변수 보간interpolation을 수행하여 속성을 동적으로 평가하고 확장할 수 있습니다. 보간의 표준 형식은 "$prefix:name"이며, 여기서 "prefix"는 보간을 수행하는 org.apache.commons.text.lookup.StringLookup 인스턴스를 찾는 데 사용됩니다. 버전 1.5부터 1.9까지의 기본 Lookup 인스턴스...

CVE-2022-42889-RCE

CVE-2022-42889-PoC CVE-2022-42889 원격 코드 실행 취약점Text4Shell 취약점의 개념 증명입니다. ⭐를 눌러 지원해 주세요 ❤️ 이 취약점에 대해 CVE-2022-42889는 Spring4Shell 및 Log4Shell과 유사한 새로운 심각한 취약점입니다. 이는 심각도 점수 9.8의 RCE원격 코드 실행 취약점입니다. 이를 통해 공격자는 공격 대상 머신에서 임의의 악성 코드를 실행할 수 있습니다. 영향을 받는 버전은 Apache Commons Text의 1.5 1.9입니다. 작동 방식 Apache...

CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

EUVD-2026-90646

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

CVE-2026-103252: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Summary The capability policy denies the env.get and env.loaddotenv modules by default, with the stated reason that they read arbitrary host environment variables API keys, DSNs and are a secret-exfil risk. But the workflow engine's variable resolver expands $env.VAR for any environment variable...

GHSA-HR7P-WG7R-HG9M Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Summary The capability policy denies the env.get and env.loaddotenv modules by default, with the stated reason that they read arbitrary host environment variables API keys, DSNs and are a secret-exfil risk. But the workflow engine's variable resolver expands $env.VAR for any environment variable...

GHSA-9G84-39MM-Q4P3 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug

The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent runs on the raw template string before getTemplateSrv.replace substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via...

CVE-2026-25125: Exposure of Sensitive Information to an Unauthorized Actor

October is a Content Management System CMS and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parseinistring function supports $ syntax for environment variable interpolation, attackers with...

CVE-2026-32301

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery SSRF when configured with a dynamic JWKS endpoint URL using template variables e.g. tenant. An unauthenticated attacker can craft a JWT with a malicious iss or...

EUVD-2022-2644

Malicious code in bioql PyPI...

CVE-2018-20885

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation SEC-416...

CVE-2019-10362

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables...

CVE-2013-4457

The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

RHEL 8 : Satellite 6.12.1 Async Security Update (Critical) (RHSA-2023:0261)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0261 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...